Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
This ways to access data from Github that was supposedly deleted was reported in this blog post.
You fork a public repository
You commit code to your fork
You delete your fork
The data commited in the deleted fork is still accessible.
You have a public repo on GitHub.
A user forks your repo.
You commit data after they fork it (and they never sync their fork with your updates).
You delete the entire repo.
Even if you deleted your repo, all the changes made to it are still accessible through the forks.
You create a private repo that will eventually be made public.
You create a private, internal version of that repo (via forking) and commit additional code for features that you’re not going to make public.
You make your “upstream” repository public and keep your fork private.
It's possible to access al the data pushed to the internal fork in the time between the internal fork was created and the public version was made public.
The same blog post propose 2 options:
If the commit ID (sha-1) value is known it's possible to access it in https://github.com/<user/org>/<repo>/commit/<commit_hash>
It's the same to access both of these:
And the latest one use a short sha-1 that is bruteforceable.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
