Back to Details

github-git-recon

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

GitHub & Git Recon

GitHub与Git侦察

Code hosts leak identities (commit emails), infrastructure (configs), and secrets (keys). All public and passive.
代码托管平台会泄露身份信息（提交邮箱）、基础设施配置（配置文件）以及密钥（凭证）。所有操作均基于公开信息且为被动式侦察。

People from commits

从提交记录获取人员信息

Every commit carries an author name + email. Pull them:
bash
git clone <repo> && git log --all --format='%an <%ae>' | sort -u
GitHub API exposes a user's repos, orgs, gists, followers, and starred repos: 
https://api.github.com/users/<user>/events/public
shows recent activity and timezone (from commit timestamps). Reused commit email → 
email-osint
; handle → 
username-osint
.
每一条提交记录都包含作者姓名和邮箱。可通过以下命令提取：
bash
git clone <repo> && git log --all --format='%an <%ae>' | sort -u
GitHub API会公开用户的仓库、组织、Gist、关注者及标星仓库：
https://api.github.com/users/<user>/events/public
可查看用户近期活动及时区信息（来自提交时间戳）。复用的提交邮箱可用于
email-osint
（邮箱开源情报）；用户名可用于
username-osint
（用户名开源情报）。

Secret hunting

密钥泄露排查

Scan repos, history, and gists for leaked credentials:
bash
trufflehog github --org=<org>        # verified secrets across an org
gitleaks detect --source=. -v        # local clone incl. full history
Deleted secrets often survive in git history and forks — always scan 
--all
history, not just HEAD. GitHub code search (
/search?type=code
) finds keys across all public repos: search the org domain, internal hostnames, or key prefixes (
AKIA
for AWS, 
ghp_
for GitHub tokens).
扫描仓库、历史记录及Gist以查找泄露的凭证：
bash
trufflehog github --org=<org>        # verified secrets across an org
gitleaks detect --source=. -v        # local clone incl. full history
已删除的密钥通常仍会保留在Git历史记录及分支中——务必扫描
--all
全部历史记录，而非仅HEAD最新版本。GitHub代码搜索（
/search?type=code
）可在所有公开仓库中查找密钥：可搜索组织域名、内部主机名或密钥前缀（如AWS的
AKIA
、GitHub令牌的
ghp_
）。

Org & infra mapping

组织与基础设施映射

  • Org members, repos, and dependencies reveal the tech stack and team.
  • Config files (
    .env.example
    , CI YAML, Terraform) leak hostnames, buckets, and service names → 
    domain-osint
    / 
    shodan-censys-recon
    .
  • Issues, PRs, and wikis contain internal discussion and real names.
  • 组织成员、仓库及依赖项可揭示技术栈与团队构成。
  • 配置文件（
    .env.example
    , CI YAML, Terraform）会泄露主机名、存储桶及服务名称 → 
    domain-osint
    / 
    shodan-censys-recon
    。
  • 问题、PR及Wiki中包含内部讨论内容与真实姓名。

Ethics

伦理规范

Finding a leaked key does not authorize using it. Report exposures responsibly; never access systems with found credentials — see ../../ETHICS.md.
发现泄露的密钥并不代表拥有使用权限。请负责任地报告泄露情况；切勿使用获取到的凭证访问系统——详情请参阅../../ETHICS.md。