Github Intentionally Lets You Read Deleted & Private Commits

Подписаться 1,9 млн

Просмотров 12 тыс.

50% 1

jh.live/snyk || Try Snyk for free and find vulnerabilities in your code and applications! ➡ jh.live/snyk
Learn Cybersecurity - Name Your Price Training with John Hammond: nameyourpricet...
Learn Coding: jh.live/codecr...
Don't listen to other "influencer" VPN crap -- host YOUR OWN: jh.live/openvpn
WATCH MORE:
Dark Web & Cybercrime Investigations: • Tracking Cybercrime on...
Malware & Hacker Tradecraft: • Malware Analysis & Thr...
📧JOIN MY NEWSLETTER ➡ jh.live/email
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/discord ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
🔥RU-vid ALGORITHM ➡ Like, Comment, & Subscribe!

Опубликовано:

11 окт 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 54

@asksearchknock 3 дня назад

Github security is totally forked 😂

@fruitloop831 3 дня назад

😂 I know right, good content, shite info IMO

@tpevers1048 3 дня назад

Na ahh they are fixing it stop telling this to everyone😢

@fruitloop831 3 дня назад

@@tpevers1048 fixing? this has been easy to do for years the only reason they "fixing" it is cos of the attention it is getting. You really think it's going to be fixed you're kidding ya self

@PwnySlaystation01 3 дня назад

I wonder what the implications to the DMCA this has. Example: I fork a major public repo and commit copyrighted code/writing to my forked copy... Say I commit the first Harry Potter novel.. My repo gets hit with a DMCA takedown request, so it gets deleted (because legally, it has to be). Now I can just post the hash and anyone can visit it? I ASSUME github can manually delete the commit "for real" in a case like this, but I'm curious. It'd have to be removed from the parent repo right? And other forks?

@amunak_ 3 дня назад

When a repo gets hit with a DMCA it disappears all its forks too iirc.

@FranLegon 3 дня назад

That's a nice exploit you're suggesting

@wizix9877 3 дня назад

was thinking the same thing but with distributing files, or kill switch in case of c2

@kaslmineer7999 3 дня назад

3:36: [discord notfication sound]

@luketurner314 3 дня назад

I legit thought it was my discord, but since I couldn't find any evidence there I replayed that bit of the video to confirm. lol

@CrittingOut 2 дня назад

3 of them this video lmfao

@takennmc 3 дня назад

you could also clone the repo and filter any commit that is normally public so it doesn't hit the api always

@TheMAZZTer 3 дня назад

The next question is does this work for DMCAed repos?

@bradley144 3 дня назад

If you know the commit hash, then yes.

@logiciananimal 3 дня назад

GitHub could be much more proactive with the rate limiting in various ways, thus lowering the risk of discovery. This is also a "can I find a way to steal *that* car" vs. "can I find a way to steal *a* car" situation, which is context dependent.

@guiorgy 2 дня назад

It's a cat and mouse game. If there's a rate limit on each ip, just get a couple of systems, maybe rent them, and increase the scanning speed that way

@MD101-ssh 3 дня назад

dude, that's crazy.

@stephanreiken9912 13 часов назад

It means it lies to you when it says you 'deleted' it

@ParabolicLabs 3 дня назад

I always recommend hosting your own git server with SSH keys for auth specifically for private repos.

@mingxi1055 3 дня назад

concerning, indeed.

@MyRandomness987 3 дня назад

3 total discord sounds heard lol. Love your videos!

@alexanderw4714 3 дня назад

Is this related to github only? What's about Gitlab?

@Jay-uk8uw 10 часов назад

for those on github that accidentally uploaded a secrets containing file. only to delete it seconds later with high hopes... rip

@xanzut 2 дня назад

So if you somehow found a sensitive information from some company in github, you can fork the repo, and still can access the information even the original repo is deleted 😂their IT security would cry for this

@austinmurphy9074 3 дня назад

you gotta turn off your discord notification sounds when you record 😆

@austinmurphy9074 3 дня назад

so if someone forks a public repo then makes it private, are those commits accessible from the public upstream one? 🤔

@HEXiT_ 3 дня назад

this is common. you delete something and it doesnt get deleted. just your access to it is removed. meta and google both do the same too :(

@badura.develop 2 дня назад

It's called soft delete, try to learn a thing or 2 about it, and you'll learn why most of companies are doing it.

@HEXiT_ День назад

@@badura.develop i have a broad outline about why its done. already.. i would mash my brain if i looked deeper :D but. some do it because of government requests/demands. uk gov requires an 18 month cache for instance on all social media platforms of a certain size. but most do it because its profitable to retain data that's been "abandoned"

@icebice 3 дня назад

SHA1 isn't actually long so brute forcing a repo with X amounts of proxies/VPN is still viable and there are a lot of VPN and proxies available on the internet 😅 Yeah it'll be slow but it will in the end successfully gain access to viable data.

@planixxx 3 дня назад

Why not count from 0 to 65535 in hexadecimal it will be between 0x0000 FFFF which will include the whole range. am i missing something here ?

@Darius1013 3 дня назад

This is exactly what Itertools.Product() does, but instead: 0x0000 0x0001 ... 0xfff you will get (if used with JH sequence): 0xaaaa 0xaaab ... 0xaaa1 0xaaa2 .. 0xfff0 .. 0xffff if you want 0000 to ffff, initial chars = '0123456789abcdef'.. Ok, performance wise maybe hex+1 is faster, but it's so minimal difference.. Slowest operation here is request, and if you want flexibility (like you know initial hash for sure not have 0 in it) Itertools is way better

@Darius1013 3 дня назад

Dam, you made me look.. on 4 chars there is no difference, results in both cases comes in like 0.005s.. But if we increase it to 6 chars, hex+1 is ~20% faster, but again we are talking like 2.5s vs 2s for generation (these results using online compiler, so on real pc they probably are even lower)

@Randy-nb6fw 3 дня назад

would it be possible to use google dorking to find these or would they not really be picked up??

@Randy-nb6fw 3 дня назад

just tried but could only find people talking about related issues, POC code and people talking about it lol. maybe somebody else might have better luck

@SmilerRyanYT 3 дня назад

So just to make sure i'm understanding this correctly, if someone forks a public repo for themselves, makes it private, edits some stuff and deletes it, the original repo can still see that as long as you know the git commit hash?