mirror of
https://github.com/anotherhadi/github-recon.git
synced 2026-10-05 10:58:25 +02:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
325397dfef | ||
|
|
dab0ba2b38 | ||
|
|
98769561c3 | ||
|
|
c76953882c | ||
|
|
94fd83ecce | ||
|
|
2d01c1639f |
@@ -13,7 +13,7 @@ type EmailResult struct {
|
||||
TargetType github_recon_settings.TargetType
|
||||
|
||||
Commits CommitsResult
|
||||
Spoofing SpoofingResult
|
||||
Spoofing *SpoofingResult
|
||||
}
|
||||
|
||||
func Email(settings github_recon_settings.Settings) EmailResult {
|
||||
@@ -33,7 +33,7 @@ func Email(settings github_recon_settings.Settings) EmailResult {
|
||||
} else {
|
||||
utils.PrintTitle(settings.Silent, "🎭 Spoofing test")
|
||||
result.Spoofing = Spoofing(settings)
|
||||
if result.Spoofing.AvatarURL != "" {
|
||||
if result.Spoofing != nil && result.Spoofing.AvatarURL != "" {
|
||||
utils.PrintAvatar(settings, result.Spoofing.AvatarURL)
|
||||
}
|
||||
utils.PrintStruct(settings, result.Spoofing, 0)
|
||||
|
||||
@@ -2,6 +2,7 @@ package recon
|
||||
|
||||
import (
|
||||
"math/rand"
|
||||
"time"
|
||||
|
||||
github_recon_settings "github.com/anotherhadi/github-recon/settings"
|
||||
"github.com/anotherhadi/github-recon/utils"
|
||||
@@ -26,7 +27,8 @@ func RandomString(n int) string {
|
||||
return string(b)
|
||||
}
|
||||
|
||||
func Spoofing(s github_recon_settings.Settings) (response SpoofingResult) {
|
||||
func Spoofing(s github_recon_settings.Settings) (response *SpoofingResult) {
|
||||
response = &SpoofingResult{}
|
||||
name := "gh-recon-spoofing-" + RandomString(8)
|
||||
private := true
|
||||
autoInit := true
|
||||
@@ -41,6 +43,13 @@ func Spoofing(s github_recon_settings.Settings) (response SpoofingResult) {
|
||||
}
|
||||
utils.WaitForRateLimit(s, resp)
|
||||
|
||||
defer func() {
|
||||
_, err = s.Client.Repositories.Delete(s.Ctx, repo.Owner.GetLogin(), name)
|
||||
if err != nil {
|
||||
s.Logger.Error("Error while deleting repo", "err", err)
|
||||
}
|
||||
}()
|
||||
|
||||
branch := repo.GetDefaultBranch()
|
||||
if branch == "" {
|
||||
branch = "main"
|
||||
@@ -57,7 +66,6 @@ func Spoofing(s github_recon_settings.Settings) (response SpoofingResult) {
|
||||
ref, resp, err := s.Client.Git.GetRef(s.Ctx, repo.Owner.GetLogin(), name, refName)
|
||||
if err != nil {
|
||||
s.Logger.Error("Error while getting ref", "err", err)
|
||||
s.Logger.Warn("The temp repo was left undeleted", "repo", repo.GetHTMLURL())
|
||||
return
|
||||
}
|
||||
utils.WaitForRateLimit(s, resp)
|
||||
@@ -65,7 +73,6 @@ func Spoofing(s github_recon_settings.Settings) (response SpoofingResult) {
|
||||
parentCommit, resp, err := s.Client.Git.GetCommit(s.Ctx, repo.Owner.GetLogin(), name, ref.GetObject().GetSHA())
|
||||
if err != nil {
|
||||
s.Logger.Error("Error while getting parent commit", "err", err)
|
||||
s.Logger.Warn("The temp repo was left undeleted", "repo", repo.GetHTMLURL())
|
||||
return
|
||||
}
|
||||
utils.WaitForRateLimit(s, resp)
|
||||
@@ -81,7 +88,6 @@ func Spoofing(s github_recon_settings.Settings) (response SpoofingResult) {
|
||||
newCommit, resp, err := s.Client.Git.CreateCommit(s.Ctx, repo.Owner.GetLogin(), name, commit, nil)
|
||||
if err != nil {
|
||||
s.Logger.Error("Error while creating spoofed empty commit", "err", err)
|
||||
s.Logger.Warn("The temp repo was left undeleted", "repo", repo.GetHTMLURL())
|
||||
return
|
||||
}
|
||||
utils.WaitForRateLimit(s, resp)
|
||||
@@ -90,31 +96,35 @@ func Spoofing(s github_recon_settings.Settings) (response SpoofingResult) {
|
||||
_, resp, err = s.Client.Git.UpdateRef(s.Ctx, repo.Owner.GetLogin(), name, ref, false)
|
||||
if err != nil {
|
||||
s.Logger.Error("Error while updating ref to spoofed commit", "err", err)
|
||||
s.Logger.Warn("The temp repo was left undeleted", "repo", repo.GetHTMLURL())
|
||||
return
|
||||
}
|
||||
utils.WaitForRateLimit(s, resp)
|
||||
|
||||
const maxRetries = 5
|
||||
const retryDelay = 2 * time.Second
|
||||
for i := 0; i < maxRetries; i++ {
|
||||
commits, _, err := s.Client.Repositories.ListCommits(s.Ctx, repo.Owner.GetLogin(), name, nil)
|
||||
if err != nil {
|
||||
s.Logger.Error("Error while listing commits", "err", err)
|
||||
s.Logger.Warn("The temp repo was left undeleted", "repo", repo.GetHTMLURL())
|
||||
return
|
||||
}
|
||||
|
||||
if len(commits) > 0 {
|
||||
if len(commits) > 1 {
|
||||
last := commits[0]
|
||||
response.Username = last.GetAuthor().GetLogin()
|
||||
response.Name = last.GetAuthor().GetName()
|
||||
response.Email = last.GetAuthor().GetEmail()
|
||||
response.Url = last.GetAuthor().GetHTMLURL()
|
||||
response.AvatarURL = last.GetAuthor().GetAvatarURL()
|
||||
break
|
||||
}
|
||||
|
||||
_, err = s.Client.Repositories.Delete(s.Ctx, repo.Owner.GetLogin(), name)
|
||||
if err != nil {
|
||||
s.Logger.Error("Error while deleting repo", "err", err)
|
||||
s.Logger.Info("Only one commit found, retrying...", "attempt", i+1)
|
||||
time.Sleep(retryDelay)
|
||||
}
|
||||
|
||||
if response.Username == "" && response.Name == "" && response.Email == "" {
|
||||
return nil
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
@@ -139,6 +139,11 @@ func DeepScan(s github_recon_settings.Settings) (response DeepScanResult) {
|
||||
}
|
||||
s.Logger.Info("Cloned all repositories", "path", tmp_folder)
|
||||
|
||||
if len(repositories) == 0 {
|
||||
s.Logger.Info("No repositories found for the user, skipping deep scan.")
|
||||
return
|
||||
}
|
||||
|
||||
authorOccurrences := Authors{}
|
||||
mapAuthorToIndex := make(map[string]int)
|
||||
for _, repo := range repositories {
|
||||
@@ -202,7 +207,7 @@ func DeepScan(s github_recon_settings.Settings) (response DeepScanResult) {
|
||||
Name: authorName,
|
||||
Email: authorEmail,
|
||||
FoundIn: []string{repoIdentifier},
|
||||
Levenshtein: utils.LevenshteinDistance(s.Target, authorName),
|
||||
Levenshtein: levenshteinDistanceAuthor(s.Target, authorName, authorEmail),
|
||||
})
|
||||
mapAuthorToIndex[trimmedLine] = len(authorOccurrences) - 1
|
||||
}
|
||||
@@ -334,13 +339,13 @@ func findEmailsAndOccurrencesInDir(rootPath string, username string) (Emails, er
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !d.IsDir() {
|
||||
if d.Type().IsRegular() {
|
||||
if strings.Contains(path, ".git/logs/") {
|
||||
return nil
|
||||
}
|
||||
content, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return err
|
||||
return nil
|
||||
}
|
||||
|
||||
currentFileEmails := emailRegex.FindAllString(string(content), -1)
|
||||
@@ -380,3 +385,10 @@ func findEmailsAndOccurrencesInDir(rootPath string, username string) (Emails, er
|
||||
|
||||
return results, nil
|
||||
}
|
||||
|
||||
func levenshteinDistanceAuthor(target, name, email string) int {
|
||||
if strings.Contains(email, "@") {
|
||||
email = strings.SplitN(email, "@", 2)[0]
|
||||
}
|
||||
return slices.Min([]int{utils.LevenshteinDistance(target, name), utils.LevenshteinDistance(target, email)})
|
||||
}
|
||||
|
||||
+3
-1
@@ -57,7 +57,9 @@ func PrintStruct(settings github_recon_settings.Settings, s any, indent int) {
|
||||
for i := 0; i < v.NumField(); i++ {
|
||||
field := t.Field(i).Name
|
||||
value := v.Field(i)
|
||||
|
||||
if !value.CanInterface() {
|
||||
continue
|
||||
}
|
||||
if !value.IsValid() || (value.Kind() == reflect.String && value.String() == "") {
|
||||
continue
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user