Ta-Lun Yen evanslify

Environment

The steps shown below are done on a Ubuntu VM using Qemu 3.0

$ qemu-system-arm -version
QEMU emulator version 3.0.0
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

To quit Qemu at any time press Ctrl+a x, i.e. Ctrl+a and then x

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output


	# firsrun:
	# install xcode-cli-tools
	# xcode-select --install
	# install homebrew
	# ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
	# install caskroom
	# brew install caskroom/cask/brew-cask

	# update/install:

	require('tap-browser-color')();
	var test = require('tape');

	test('it flattens!', function(t) {
	var input = {
	users: [
	{ name: 'name1', id: 1, image: { '64x64': 'http://1' } },
	{ name: 'name2', id: 2, image: { '64x64': 'http://2' } }
	],
	errors: [ new Error('err1') ],

	jQuery.base64 = (function($) {

	// private property
	var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

	// private method for UTF-8 encoding
	function utf8Encode(string) {
	string = string.replace(/\r\n/g,"\n");
	var utftext = "";
	for (var n = 0; n < string.length; n++) {

	#
	# Very simple script that uses birthday paradox to find collision for hash function H(x)
	# that truncates the output of SHA-256(x) to 50 bits. Written for cryptography class.
	# See [Stinson, 2005] for why this works.
	#

	import hashlib
	import os
	import binascii


	<?

	/*

	popfinder.php - Emilio Pinna 2013

	Popfinder is a simple script that can helps code analysis of PHP in case of possible object
	injection[1][2] in unserialize function.

	#!/bin/bash

	sudo kextunload -b com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport
	sudo kextload -b com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport