gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/README.md', 'src/banners/hacktricks-training.md', 'src/

Browse Source
This commit is contained in:
Translator
2024-12-31 20:17:46 +00:00
parent d6ce9cef2b
commit 20ad0aabbd
245 changed files with 9486 additions and 12194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md
+18 -22
View File
@@ -2,59 +2,55 @@
{{#include ../../banners/hacktricks-training.md}}
This ways to access data from Github that was supposedly deleted was [**reported in this blog post**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github).
이 방법은 삭제된 것으로 보이는 Github의 데이터에 접근하는 방법입니다 [**이 블로그 게시물에서 보고되었습니다**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github).
## Accessing Deleted Fork Data
1. You fork a public repository
2. You commit code to your fork
3. You delete your fork
1. 공개 저장소를 포크합니다.
2. 포크에 코드를 커밋합니다.
3. 포크를 삭제합니다.
> [!CAUTION]
> The data commited in the deleted fork is still accessible.
> 삭제된 포크에 커밋된 데이터는 여전히 접근 가능합니다.
## Accessing Deleted Repo Data
1. You have a public repo on GitHub.
2. A user forks your repo.
3. You commit data after they fork it (and they never sync their fork with your updates).
4. You delete the entire repo.
1. GitHub에 공개 저장소가 있습니다.
2. 사용자가 귀하의 저장소를 포크합니다.
3. 그들이 포크한 후에 데이터를 커밋합니다 (그리고 그들은 결코 포크를 귀하의 업데이트와 동기화하지 않습니다).
4. 전체 저장소를 삭제합니다.
> [!CAUTION]
> Even if you deleted your repo, all the changes made to it are still accessible through the forks.
> 저장소를 삭제하더라도, 그에 대한 모든 변경 사항은 포크를 통해 여전히 접근 가능합니다.
## Accessing Private Repo Data
1. You create a private repo that will eventually be made public.
2. You create a private, internal version of that repo (via forking) and commit additional code for features that you’re not going to make public.
3. You make your “upstream” repository public and keep your fork private.
1. 결국 공개될 개인 저장소를 생성합니다.
2. 해당 저장소의 개인 내부 버전을 생성하고 (포크를 통해) 공개하지 않을 기능에 대한 추가 코드를 커밋합니다.
3. "업스트림" 저장소를 공개하고 포크를 개인으로 유지합니다.
> [!CAUTION]
> It's possible to access al the data pushed to the internal fork in the time between the internal fork was created and the public version was made public.
> 내부 포크가 생성된 시점과 공개 버전이 공개된 시점 사이에 푸시된 모든 데이터에 접근할 수 있습니다.
## How to discover commits from deleted/hidden forks
The same blog post propose 2 options:
같은 블로그 게시물은 2가지 옵션을 제안합니다:
### Directly accessing the commit
If the commit ID (sha-1) value is known it's possible to access it in `https://github.com/<user/org>/<repo>/commit/<commit_hash>`
커밋 ID (sha-1) 값이 알려져 있다면 `https://github.com/<user/org>/<repo>/commit/<commit_hash>`에서 접근할 수 있습니다.
### Brute-forcing short SHA-1 values
It's the same to access both of these:
두 가지 모두 접근하는 방법은 동일합니다:
- [https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14](https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14)
- [https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463](https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463)
And the latest one use a short sha-1 that is bruteforceable.
그리고 마지막 링크는 브루트포스 가능한 짧은 sha-1을 사용합니다.
## References
- [https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github)
{{#include ../../banners/hacktricks-training.md}}