mirror of
https://github.com/anotherhadi/blog.git
synced 2026-04-02 11:42:10 +02:00
Typo
Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>
This commit is contained in:
@@ -6,9 +6,9 @@ tags: ["osint", "github", "cybersecurity", "profile"]
|
|||||||
publishDate: "2026-01-01"
|
publishDate: "2026-01-01"
|
||||||
---
|
---
|
||||||
|
|
||||||
In the world of Open-Source Intelligence (OSINT), we often focus on social media platforms like Twitter or LinkedIn. However, developers frequently leave behind much more detailed personal information on **GitHub**.
|
In the world of Open-Source Intelligence (OSINT), we often focus on social media platforms like Twitter or LinkedIn. However, developers frequently leave behind much more detailed personal information on **Github**.
|
||||||
|
|
||||||
Whether you are a recruiter, a security researcher, or a digital investigator, GitHub is a goldmine. Why? Because while a user might choose a cryptic handle like `anotherhadi`, their Git configuration often reveals their real name and email address.
|
Whether you are a recruiter, a security researcher, or a digital investigator, Github is a goldmine. Why? Because while a user might choose a cryptic handle like `anotherhadi`, their Git configuration often reveals their real name and email address.
|
||||||
|
|
||||||
## Level 1: The Low-Hanging Fruit
|
## Level 1: The Low-Hanging Fruit
|
||||||
|
|
||||||
@@ -16,11 +16,11 @@ Before diving into technical exploits, start with the obvious. Many users forget
|
|||||||
|
|
||||||
- **The Bio & Location**: Even a vague location like "Montpellier, France," combined with a niche tech stack (e.g., "COBOL expert"), significantly narrows down the search.
|
- **The Bio & Location**: Even a vague location like "Montpellier, France," combined with a niche tech stack (e.g., "COBOL expert"), significantly narrows down the search.
|
||||||
- **External Links**: Check the personal website or blog link. Run a WHOIS lookup on that domain to find registration details. Use other OSINT tools and techniques on those websites to pivot further.
|
- **External Links**: Check the personal website or blog link. Run a WHOIS lookup on that domain to find registration details. Use other OSINT tools and techniques on those websites to pivot further.
|
||||||
- **The Profile Picture**: Right-click the avatar and use Google Reverse Image Search, Yandex, or other reverse image engines. Developers often use the same professional headshot on GitHub as they do on LinkedIn.
|
- **The Profile Picture**: Right-click the avatar and use Google Reverse Image Search, Yandex, or other reverse image engines. Developers often use the same professional headshot on Github as they do on LinkedIn.
|
||||||
|
|
||||||
## Level 2: Digging into Commits
|
## Level 2: Digging into Commits
|
||||||
|
|
||||||
This is the most **powerful technique in GitHub OSINT**. When a developer commits code, Git attaches an author name and an email address to that commit. GitHub hides these in the UI, but they remain embedded in the metadata.
|
This is the **most effective OSINT** method. While Github masks author names and emails in the web view, this information is permanently embedded in the commit metadata.
|
||||||
|
|
||||||
### The `.patch` Method
|
### The `.patch` Method
|
||||||
|
|
||||||
@@ -29,35 +29,35 @@ Find a repository where the target has contributed. Open any commit they made, a
|
|||||||
- **URL**: `https://github.com/{username}/{repo}/commit/{commit_hash}.patch`
|
- **URL**: `https://github.com/{username}/{repo}/commit/{commit_hash}.patch`
|
||||||
- Look at the `From:` line. It should look like this: `From: John Doe <j.doe@company.com>`
|
- Look at the `From:` line. It should look like this: `From: John Doe <j.doe@company.com>`
|
||||||
|
|
||||||
For example, check: `https://github.com/anotherhadi/nixy/commit/e6873e8caae491073d8ab7daad9d2e50a04490ce.patch`
|
For example, check: [github.com/anotherhadi/nixy/commit/e6873e8caae491073d8ab7daad9d2e50a04490ce.patch](https://github.com/anotherhadi/nixy/commit/e6873e8caae491073d8ab7daad9d2e50a04490ce.patch)
|
||||||
|
|
||||||
### The API Events Method
|
### The API Events Method
|
||||||
|
|
||||||
If you cannot find a recent commit, check their **public activity** stream via the GitHub API.
|
If you cannot find a recent commit, check their **public activity** stream via the Github API.
|
||||||
|
|
||||||
- **Go to**: `https://api.github.com/users/{target_username}/events/public`
|
- **Go to**: `https://api.github.com/users/{target_username}/events/public`
|
||||||
- Search (Ctrl+F) for the word `email`. You will often find the **email address** associated with their `PushEvent` headers, even if they have "Keep my email addresses private" enabled in their current settings.
|
- Search (Ctrl+F) for the word `email`. You will often find the **email address** associated with their `PushEvent` headers, even if they have "Keep my email addresses private" enabled in their current settings.
|
||||||
|
|
||||||
### The Email Spoofing Method
|
### The Email Spoofing Method
|
||||||
|
|
||||||
While the previous methods help you find an email _from_ a profile, this technique does the opposite: it identifies which GitHub account is linked to a specific email address.
|
While the previous methods help you find an email _from_ a profile, this technique does the opposite: it identifies which Github account is linked to a specific email address.
|
||||||
|
|
||||||
**How it works:**
|
**How it works:**
|
||||||
GitHub attributes commits based on the email address found in the Git metadata. If you push a commit using a specific email, GitHub will automatically link that commit to the account associated with that address as its **primary email**.
|
Github attributes commits based on the email address found in the Git metadata. If you push a commit using a specific email, Github will automatically link that commit to the account associated with that address as its **primary email**.
|
||||||
|
|
||||||
**The Process:**
|
**The Process:**
|
||||||
|
|
||||||
1. **Initialize a local repo:** `git init investigation`
|
1. **Initialize a local repo:** `git init investigation`
|
||||||
2. **Configure the target email:** `git config user.email "target@example.com"` and `git config user.name "A Username"`
|
2. **Configure the target email:** `git config user.email "target@example.com"` and `git config user.name "A Username"`
|
||||||
3. **Create a dummy commit:** `echo "test" > probe.txt && git add . && git commit -m "Probe"`
|
3. **Create a dummy commit:** `echo "test" > probe.txt && git add . && git commit -m "Probe"`
|
||||||
4. **Push to a repo you own:** Create a new empty repository on your GitHub account and push the code there.
|
4. **Push to a repo you own:** Create a new empty repository on your Github account and push the code there.
|
||||||
5. **Observe the result:** Go to the commit history on the GitHub web interface. The avatar and username of the account linked to that email will appear as the author of the commit.
|
5. **Observe the result:** Go to the commit history on the Github web interface. The avatar and username of the account linked to that email will appear as the author of the commit.
|
||||||
|
|
||||||
> **Note:** This method only works if the target email is set as the **Primary Email** on the user's account. It is a foolproof way to confirm if an email address you found elsewhere belongs to a specific GitHub user.
|
> **Note:** This method only works if the target email is set as the **Primary Email** on the user's account. It is a foolproof way to confirm if an email address you found elsewhere belongs to a specific Github user.
|
||||||
|
|
||||||
## Level 3: Technical Metadata
|
## Level 3: Technical Metadata
|
||||||
|
|
||||||
If the email is masked or missing, we can look at the **cryptographic keys** the user uses to communicate with GitHub.
|
If the email is masked or missing, we can look at the **cryptographic keys** the user uses to communicate with Github.
|
||||||
|
|
||||||
### SSH Keys
|
### SSH Keys
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user