first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,142 @@
+- Most tools designed to scan Github are targetted at a single repo or organization. This is the opposite of what a red teamer wants: they want to scour *all* repos, including (especially) private repos, for information related to the target organization
+- [github-subdomains](https://github.com/gwen001/github-subdomains.git)
+	- Scrapes Github for any subdomains of the target. 
+	- You'll need many API keys and many runs to complete this method
+- Github Dorking
+	- [Gdorklinks.sh](https://gist.github.com/jhaddix/1fb7ab2409ab579178d2a79959909b33#file-gdorklinks-sh)
+		- Hugely useful Haddix script to auto-generate Github dorking links
+		- Usage:
+			1. download the script
+			2. `chmod +x Gdorklinks.sh`
+			3. `./Gdorklinks.sh NameOfSomeCompanyMaybe`
+			4. Paste links into browser
+	- Useful queries:
+		- `org:<org_name> password`
+		- `org:<org_name> aws_secret_access_key`
+		- `org:<org_name> aws_key`
+		- `org:<org_name> BEGIN RSA PRIVATE KEY`
+		- `org:<org_name> BEGIN OPENSSH PRIVATE KEY`
+		- `org:<org_name> secret_key`
+		- `org:<org_name> hooks.slack.com/services`
+		- `org:<org_name> sshpass -p`
+		- `org:<org_name> sq0csp`
+		- `org:<org_name> apps.googleusercontent.com`
+		- `org:<org_name> extension:pem key`
+- Searching Repos for Sensitive Info:
+	1. Download all repos:
+		- `while read p; do git clone www.github.com/<org_name>/$p; done`
+	2. Use the "Useful Grep Regexes" page included in the Necronomicon to search:
+		- `egrep -Ri -f regex_patterns.txt *`
+	3. Search past commits:
+		- `git rev-list --all | xargs git grep "BEGIN [EC|RSA|DSA|OPENSSH] PRIVATE KEY"`
+		- `git rev-list --all | xargs git grep "aws_secret"`
+- [github-search](https://github.com/gwen001/github-search)
+- [@th3g3ntelman's "Github and Sensitive Data Exposure"](https://www.youtube.com/watch?v=l0YsEk_59fQ)
+- Internal packages and libraries
+	- Companies often create internal libraries and packages, some of which accidentally get published
+	- Check for archival: https://www.skypack.dev/
+	- List npm contributors that have access to modify a package:
+		- `npm owner ls <package_name>`
+
+```BASH
+#!/bin/bash
+without_suffix=`echo $1|cut -d . -f1`
+echo ""
+echo "************ Github Dork Links (must be logged in) *******************"
+echo "  password"
+echo "https://github.com/search?q=%22$1%22+password&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+password&type=Code"
+echo " npmrc _auth"
+echo "https://github.com/search?q=%22$1%22+npmrc%20_auth&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+npmrc%20_auth&type=Code"
+echo " dockercfg"
+echo "https://github.com/search?q=%22$1%22+dockercfg&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+dockercfg&type=Code"
+echo "  pem private"
+echo "https://github.com/search?q=%22$1%22+pem%20private&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+extension:pem%20private&type=Code"
+echo "  id_rsa"
+echo "https://github.com/search?q=%22$1%22+id_rsa&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+id_rsa&type=Code"
+echo " aws_access_key_id"
+echo "https://github.com/search?q=%22$1%22+aws_access_key_id&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+aws_access_key_id&type=Code"
+echo "  s3cfg"
+echo "https://github.com/search?q=%22$1%22+s3cfg&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+s3cfg&type=Code"
+echo " htpasswd"
+echo "https://github.com/search?q=%22$1%22+htpasswd&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+htpasswd&type=Code"
+echo " git-credentials"
+echo "https://github.com/search?q=%22$1%22+git-credentials&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+git-credentials&type=Code"
+echo " bashrc password"
+echo "https://github.com/search?q=%22$1%22+bashrc%20password&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+bashrc%20password&type=Code"
+echo " sshd_config"
+echo "https://github.com/search?q=%22$1%22+sshd_config&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+sshd_config&type=Code"
+echo " xoxp OR xoxb OR xoxa"
+echo "https://github.com/search?q=%22$1%22+xoxp%20OR%20xoxb%20OR%20xoxa&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+xoxp%20OR%20xoxb&type=Code"
+echo "  SECRET_KEY"
+echo "https://github.com/search?q=%22$1%22+SECRET_KEY&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+SECRET_KEY&type=Code"
+echo " client_secret"
+echo "https://github.com/search?q=%22$1%22+client_secret&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+client_secret&type=Code"
+echo " sshd_config"
+echo "https://github.com/search?q=%22$1%22+sshd_config&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+sshd_config&type=Code"
+echo " github_token"
+echo "https://github.com/search?q=%22$1%22+github_token&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+github_token&type=Code"
+echo "  api_key"
+echo "https://github.com/search?q=%22$1%22+api_key&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+api_key&type=Code"
+echo " FTP"
+echo "https://github.com/search?q=%22$1%22+FTP&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+FTP&type=Code"
+echo " app_secret"
+echo "https://github.com/search?q=%22$1%22+app_secret&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+app_secret&type=Code"
+echo "  passwd"
+echo "https://github.com/search?q=%22$1%22+passwd&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+passwd&type=Code"
+echo " s3.yml"
+echo "https://github.com/search?q=%22$1%22+.env&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+.env&type=Code"
+echo " .exs"
+echo "https://github.com/search?q=%22$1%22+.exs&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+.exs&type=Code"
+echo " beanstalkd.yml"
+echo "https://github.com/search?q=%22$1%22+beanstalkd.yml&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+beanstalkd.yml&type=Code"
+echo " deploy.rake"
+echo "https://github.com/search?q=%22$1%22+deploy.rake&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+deploy.rake&type=Code"
+echo " mysql"
+echo "https://github.com/search?q=%22$1%22+mysql&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+mysql&type=Code"
+echo " credentials"
+echo "https://github.com/search?q=%22$1%22+credentials&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+credentials&type=Code"
+echo "  PWD"
+echo "https://github.com/search?q=%22$1%22+PWD&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+PWD&type=Code"
+echo " deploy.rake"
+echo "https://github.com/search?q=%22$1%22+deploy.rake&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+deploy.rake&type=Code"
+echo " .bash_history"
+echo "https://github.com/search?q=%22$1%22+.bash_history&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+.bash_history&type=Code"
+echo " .sls"
+echo "https://github.com/search?q=%22$1%22+.sls&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+PWD&type=Code"
+echo " secrets"
+echo "https://github.com/search?q=%22$1%22+secrets&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+secrets&type=Code"
+echo " composer.json"
+echo "https://github.com/search?q=%22$1%22+composer.json&type=Code"
+echo "https://github.com/search?q=%22$without_suffix%22+composer.json&type=Code"
+```
@@ -0,0 +1,75 @@
+```
+^.*_rsa$
+^.*_dsa$
+^.*_ed25519$
+^.*_ecdsa$
+\.?ssh/config$
+^key(pair)?$
+^\.?(bash_|zsh_|sh_|z)?history$
+^\.?mysql_history$
+^\.?psql_history$
+^\.?pgpass$
+^\.?irb_history$
+\.?purple/accounts\.xml$
+\.?xchat2?/servlist_?\.conf$
+\.?irssi/config$
+\.?recon-ng/keys\.db$
+^\.?dbeaver-data-sources.xml$
+^\.?muttrc$
+^\.?s3cfg$
+\.?aws/credentials$
+^sftp-config(\.json)?$
+^\.?trc$
+^\.?(bash|zsh|csh)rc$
+^\.?(bash_|zsh_)?profile$
+^\.?(bash_|zsh_)?aliases$
+config(\.inc)?\.php$
+^key(store|ring)$
+^kdbx?$
+^sql(dump)?$
+^\.?htpasswd$
+^(\.|_)?netrc$
+\.?gem/credentials$
+^\.?tugboat$
+doctl/config.yaml$
+^\.?git-credentials$
+config/hub$
+^\.?gitconfig$
+\.?chef/(.*)\.pem$
+etc/shadow$
+etc/passwd$
+^\.?dockercfg$
+^\.?npmrc$
+^\.?env$
+-----BEGIN [EC|RSA|DSA|OPENSSH] PRIVATE KEY----
+(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
+(("|'|`)?((?i)aws)?_?((?i)access)_?((?i)key)?_?((?i)id)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}("|'|`)?)
+(("|'|`)?((?i)aws)?_?((?i)account)_?((?i)id)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?[0-9]{4}-?[0-9]{4}-?[0-9]{4}("|'|`)?)
+(("|'|`)?((?i)aws)?_?((?i)secret)_?((?i)access)?_?((?i)key)?_?((?i)id)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?[A-Za-z0-9/+=]{40}("|'|`)?)
+(("|'|`)?((?i)aws)?_?((?i)session)?_?((?i)token)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?[A-Za-z0-9/+=]{16,}("|'|`)?)
+(?i)artifactory.{0,50}("|'|`)?[a-zA-Z0-9=]{112}("|'|`)?
+(?i)codeclima.{0,50}("|'|`)?[0-9a-f]{64}("|'|`)?
+EAACEdEose0cBA[0-9A-Za-z]+
+(("|'|`)?type("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?service_account("|'|`)?,?)
+(?:r|s)k_[live|test]_[0-9a-zA-Z]{24}
+[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
+AIza[0-9A-Za-z\\-_]{35}
+ya29\\.[0-9A-Za-z\\-_]+
+sk_[live|test]_[0-9a-z]{32}
+sq0atp-[0-9A-Za-z\-_]{22}
+sq0csp-[0-9A-Za-z\-_]{43}
+access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}
+amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
+SK[0-9a-fA-F]{32}
+key-[0-9a-zA-Z]{32}
+[0-9a-f]{32}-us[0-9]{12}
+sshpass -p.*['|"]
+(https\\://outlook\\.office.com/webhook/[0-9a-f-]{36}\\@)
+(?i)sauce.{0,50}("|'|`)?[0-9a-f-]{36}("|'|`)?
+(xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})
+https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}
+(?i)sonar.{0,50}("|'|`)?[0-9a-f]{40}("|'|`)?
+(?i)hockey.{0,50}("|'|`)?[0-9a-f]{32}("|'|`)?
+([\w+]{1,24})(://)([^$<]{1})([^\s";]{1,}):([^$<]{1})([^\s";]{1,})@[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,24}([^\s]+)
+oy2[a-z0-9]{43}
+```