mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-22 15:16:35 -08:00
86 lines
4.5 KiB
Markdown
86 lines
4.5 KiB
Markdown
# Accessible Deleted Data in Github
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|
||
|
||
This ways to access data from Github that was supposedly deleted was [**reported in this blog post**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github).
|
||
|
||
## Accessing Deleted Fork Data
|
||
|
||
1. You fork a public repository
|
||
2. You commit code to your fork
|
||
3. You delete your fork
|
||
|
||
{% hint style="danger" %}
|
||
The data commited in the deleted fork is still accessible.
|
||
{% endhint %}
|
||
|
||
## Accessing Deleted Repo Data
|
||
|
||
1. You have a public repo on GitHub.
|
||
2. A user forks your repo.
|
||
3. You commit data after they fork it (and they never sync their fork with your updates).
|
||
4. You delete the entire repo.
|
||
|
||
{% hint style="danger" %}
|
||
Even if you deleted your repo, all the changes made to it are still accessible through the forks.
|
||
{% endhint %}
|
||
|
||
## Accessing Private Repo Data
|
||
|
||
1. You create a private repo that will eventually be made public.
|
||
2. You create a private, internal version of that repo (via forking) and commit additional code for features that you’re not going to make public.
|
||
3. You make your “upstream” repository public and keep your fork private.
|
||
|
||
{% hint style="danger" %}
|
||
It's possible to access al the data pushed to the internal fork in the time between the internal fork was created and the public version was made public.
|
||
{% endhint %}
|
||
|
||
## How to discover commits from deleted/hidden forks
|
||
|
||
The same blog post propose 2 options:
|
||
|
||
### Directly accessing the commit
|
||
|
||
If the commit ID (sha-1) value is known it's possible to access it in `https://github.com/<user/org>/<repo>/commit/<commit_hash>`
|
||
|
||
### Brute-forcing short SHA-1 values
|
||
|
||
It's the same to access both of these:
|
||
|
||
* [https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14](https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14)
|
||
* [https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463](https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463)
|
||
|
||
And the latest one use a short sha-1 that is bruteforceable.
|
||
|
||
## References
|
||
|
||
* [https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github)
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|