News for hackers. Stuff that matters.
Re:Characterizing secret leakage in public GitHub repositories by aiddun on Tuesday April 09, 2019 @01:04AM (#19611940)
My sophomore year of high school, I was trying to writing a Discord (chat platform) bot for a server I shared with friends and unknowingly included the private key in a public repo I hoped to show them. A specifically written crawler for Discord keys found the key and starting spamming the server with images of very very undesirable things from the far corners of the internet at a rate of hundreds per second. Needless to say I learned my lesson the hard way.
Re:Characterizing secret leakage in public GitHub repositories by HNLurker2 on Tuesday April 09, 2019 @01:20AM (#19612007)
Couldn't we use Google's bigquery to search for private keys?
Re:Characterizing secret leakage in public GitHub repositories by sbmthakur on Tuesday April 09, 2019 @03:12AM (#19612472)
Thanks for sharing! How do people write such crawlers? Do they specifically point them at Github repos?
Re:Characterizing secret leakage in public GitHub repositories by yorwba on Tuesday April 09, 2019 @03:48AM (#19612606)
The paper discussed in the article describes writing such a crawler. They simply use the GitHub search API.