Skip to content

Instantly share code, notes, and snippets.

View skepticfx's full-sized avatar
:octocat:

Nafeez skepticfx

:octocat:
307 followers · 0 following
View GitHub Profile
@EdOverflow
EdOverflow / github_bugbountyhunting.md
Last active October 24, 2025 09:41
My tips for finding security issues in GitHub projects.

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output
@jesusprubio
jesusprubio / gist:8f092af4ca252e252eab
Last active April 12, 2023 15:02
Proposal: A Node.js penetration test framework

Proposal: Node.js penetration test framework

Hi guys! Since I started to write Bluebox-ng I've been tracking the different security projects I found written in Node.js. Now we've published the first stable version we think it's the right moment to speak among us (and, of course, everyone interested in it :).

Why?

  • I think we're rewriting the same stuff in our respective projects again and again. For example, almost any tool supports IPv6 because the functions we need are still not present in the Node core and the libraries I found (IMHO) were not enough.
  • There're different projects implementing exactly the same thing, ie: port scanners.
  • We're working in a too new environment, so we need to make it together.
@dominictarr
dominictarr / CYPHERLINK.md
Last active October 8, 2025 08:01
Cypherlinks