1.0 Information Gathering
ssl.cert.subject.CN:"*.target.com" http.html:"Log in, username, password" http.title:"Admin" 200 http.html:"Test, news, support"TargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQueryTargetQuerykibana content-length:217 net:”cidr” org:”Amazon” ssl:”target” ssl:”target” html:”Dashboard Jenkins” http.component:”jenkins” http.title:”302 Found” http.component%3A”java” <https://www.shodan.io/host/ip#9200> <https://www.shodan.io/host/ip> X-Redirect-By: WordPress ssl:”name” query: html:”eBay Inc. All Right Reserved” X-Amz-Bucket-Region x-jenkins 200 X-Generator: Drupal 7 ssl:Google org:’Name’ port:’80’ all:”mongodb server information” all:”metrics” port:27017 -all:”partially” all:”fs.files” port:”9200" all:”elastic indices” product:elastic port:9200 product: CouchDB title:”system dashboard” html:jira product: “apache tomcat” ssl%3A”development”+org%3A”Amazon.com”+port%3A”number” http.component:ruby port:3000 html:”secret_key_base” html:”rack.version” http.html:QUERY ssl:”domain.com” http.favicon.hash:81586312 200 html:/dana-na/ Pulse Secure VPN exploitSECRET GITHUB DORKING METHODOLOGY UNRAVELLED! 1. When you go to do Github Dorking, what is the first thing you do? ==> You find your target's Github Page. 2. Then 50% of the time, you won't find leaks on their main github page, are there any other in-scope pages for github dorking? ==> Yes! When you go to the target's github page, if you scroll down you will see a tab called People. It has the employees that are officially working with your target. 3. Now from the People tab go to any employee's github page. ==> All of the Employees mentioned in the People tab are in-scope for Github dorking! How cool is that?! You just got more attack surface! Now remember that these employees have a life other than working for your target. Means they can push sensitive leaks but they might be of the employee's private project.(maybe his personal projects) So don't get too hyped when you see a leak by an employee, try to verify that it is information for your target, and not an external/private project of the employee. 4. The best tip: Sometimes you wont be able to find leaks by the employees in the People tab, don't worry there is still a little something to get you more attack surface :) ==> Fact- If any of the employees have leaked sensitive information in their Github Repo which is related to the company, that's a bug! Now we are gonna find the external yet still in-scope employees :) Use this google dork- site:linkedin.com intext:software engineer at TargetORG This will find you employees that work for your target company, but still are not listed in People tab. Why? ==> Maybe because they are meant to kept secret and they post sensitive stuff... You never know. Now that you found some more employees, you will find their Github Pages. Usually all Software engineers have a github page. To find their Github page use this google dork: site:github.com intext:the_employee_here or simply search "github the_employee_here" Now you got a lot of stuff to github dork to! Now you might actually find leaks!!"target.com" language:python "secret" "password" "key" NOT support NOT docs NOT sandbox NOT docker NOT container NOT test NOT fakeJenkins Jira OTP oauth authoriztion password pwd ftp ssh dotfiles JDBC token user pass secret SecretAccessKey AWS_SECRET_ACCESS_KEY credentials config security_credentialsopenssl s_client -connect 93.184.216.34:443 </dev/null 2>/dev/null | openssl x509 -noout -text | grep -E 'DNS:|Subject:' Subject: C = US, ST = California, L = Los Angeles, O = Internet Corporation for Assigned Names and Numbers, CN = www.example.org DNS:www.example.org, DNS:example.com, DNS:example.edu, DNS:example.net, DNS:example.org, DNS:www.example.com, DNS:www.example.edu, DNS:www.example.net
{ "version": 3, "file": "static/js/main.chunk.js", "sources": [ "/home/sysadmin/cashsystem/src/actions/index.js", "/home/sysadmin/cashsystem/src/actions/reportAction.js", "/home/sysadmin/cashsystem/src/actions/cashoutAction.js", "/home/sysadmin/cashsystem/src/actions/userAction.js", "..." ], "..." }
- FrameworkCookie nameApplicationKeywordFrameworkKeyword
Last updated