gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-02-05 03:16:37 -08:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/README.md', 'src/banners/hacktricks-training.md', 'src/

Browse Source
This commit is contained in:
Translator
2024-12-31 20:24:43 +00:00
parent 10e2881a9b
commit 9ce07d92a3
245 changed files with 9883 additions and 12659 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md
View File

@@ -2,59 +2,42 @@
{{#include ../../banners/hacktricks-training.md}}
This ways to access data from Github that was supposedly deleted was [**reported in this blog post**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github).
Ovi načini za pristup podacima sa GitHub-a koji su navodno obrisani su [**prijavljeni u ovom blog postu**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github).
## Accessing Deleted Fork Data
1. You fork a public repository
2. You commit code to your fork
3. You delete your fork
1. Forkujete javni repozitorijum
2. Komitujete kod u vaš fork
3. Brišete vaš fork
> [!CAUTION]
> The data commited in the deleted fork is still accessible.
> Podaci komitovani u obrisanom forku su i dalje dostupni.
## Accessing Deleted Repo Data
1. You have a public repo on GitHub.
2. A user forks your repo.
3. You commit data after they fork it (and they never sync their fork with your updates).
4. You delete the entire repo.
1. Imate javni repozitorijum na GitHub-u.
2. Korisnik fork-uje vaš repozitorijum.
3. Komitujete podatke nakon što su fork-ovali (i nikada ne sinhronizuju svoj fork sa vašim ažuriranjima).
4. Brišete ceo repozitorijum.
> [!CAUTION]
> Even if you deleted your repo, all the changes made to it are still accessible through the forks.
> Čak i ako ste obrisali vaš repozitorijum, sve promene napravljene na njemu su i dalje dostupne kroz forke.
## Accessing Private Repo Data
1. You create a private repo that will eventually be made public.
2. You create a private, internal version of that repo (via forking) and commit additional code for features that you’re not going to make public.
3. You make your “upstream” repository public and keep your fork private.
1. Kreirate privatni repozitorijum koji će na kraju postati javan.
2. Kreirate privatnu, internu verziju tog repozitorijuma (putem forkovanja) i komitujete dodatni kod za funkcije koje nećete učiniti javnim.
3. Činite vaš “upstream” repozitorijum javnim i zadržavate vaš fork privatnim.
> [!CAUTION]
> It's possible to access al the data pushed to the internal fork in the time between the internal fork was created and the public version was made public.
> Moguće je pristupiti svim podacima koji su poslati u internu fork u vremenu između kada je interna fork kreirana i kada je javna verzija postala javna.
## How to discover commits from deleted/hidden forks
The same blog post propose 2 options:
Isti blog post predlaže 2 opcije:
### Directly accessing the commit
If the commit ID (sha-1) value is known it's possible to access it in `https://github.com/<user/org>/<repo>/commit/<commit_hash>`
Ako je poznata vrednost ID-a komita (sha-1), moguće je pristupiti mu na `https://github.com/<user/org>/<repo>/commit/<commit_hash>`
### Brute-forcing short SHA-1 values
It's the same to access both of these:
- [https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14](https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14)
- [https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463](https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463)
And the latest one use a short sha-1 that is bruteforceable.
## References
- [https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github)
{{#include ../../banners/hacktricks-training.md}}