Commercial relationships between businesses and 3rd-parties require the exchange of some types of sensitive information such as employee and customer details, access to the company's network and generally access to otherwise well-guarded IT assets. As a result, there is an inherent risk in the 3rd-party services as they create a venue of attack against the company's data and internal networks. These types of cybersecurity threats are known as supply-chain attacks.

To mitigate the exposure to 3rd-party risk, businesses must perform technical security due diligence. This is often done on paper with the help of a questionnaire. While this method is widely adopted, evidently it is prone to errors and misinformation as the answers in the questionnaire are taken at face-value and never checked. This proves to be a major problem for today's growing enterprises as the risk of 3rd-party security-related incidents is continuously increasing.

## Getting Started

Technical 3rd-party due diligence is a necessary part of an effective 3rd-party risk management program. The process boils down to fingerprinting the 3rd-party public assets, identifying risks, such as compromised accounts, vulnerable software versions and exposed critical IT infrastructure, and making a decision based on the acquired information.

This is an extensive process which requires skill, access to a number of specialist tools and services and a method of aggregating data in a meaningful way. The [SecApps Scout](https://secapps.com/tools/scout) tool and its automated processes are particularly useful in such situations.

![recon graph model](//images.ctfassets.net/qgz2s3egbmql/7hDkeUldae3yPr87pWJ0JE/3fa4c23f8d2ef880d6aecb7a8387d1cf/image3.png?fm=webp)

In this tutorial, we will step through performing a full technical 3rd-party assessment of a vendor to ensure they are a good fit for our business in terms of cybersecurity and IT operations.

Once the tool is up and you are authenticated you will see your existing 3rd-party recons in your dashboard. In this example, you can see that I've been quite active with recons spanning across many vendors, vulnerability disclosure programs and more.

![secapps scout](//images.ctfassets.net/qgz2s3egbmql/XEnCGMjMKo6iMTe7RZcrH/36b45a27b474bda3d9316e3237309759/image8.png?fm=webp)

Let's add a new Scout. Click on the PLUS (+) button and type in a name and a brief description. Both fields are optional but they are very useful to remind us what this test was for especially when you have more than 150 vendors as I do.

Next, we need to set up the brands and domains fields. The brand is one of many names the 3rd-party vendor associates with. This will be used for some fuzzy searches such as identifying their own 3rd-party vendor list, GitHub repositories for source-code storage and more. The domains field contains a number of associated domains. These domains will be searched to identify insecure publicly exposed web applications, insecure services, and publicly exposed databases.

![configure scout target](//images.ctfassets.net/qgz2s3egbmql/5lvdWCv7PRDaET0qQfiTnM/dbab28d393d2c14bd554c3345fb09ad7/image2.png?fm=webp)

You can also configure a schedule, in case you want to run this assessment continuously at predefined intervals and notification options such as email and slack channel URL. We will cover both of these later in this tutorial.

Notice we need very little information to get started.

## Scout Executions

It is time to perform our first execution. Simply click on the Execute button. You will see a progress bar indicating the task progress through the various steps.

Each Scout Execution is a snapshot of the 3rd-party state at the time of the assessment. This is important because security regressions can occur randomly and while there might not be any interesting vulnerabilities today the situation could look significantly different tomorrow.

![view scout screen](//images.ctfassets.net/qgz2s3egbmql/2CFN4sdoTtxvB9wHBrf2jW/e9d62b4e310da28f757d308b95da72bc/image7.png?fm=webp)

The test is completed and now we need to take a look at the results. Keep in mind that [SecApps Scout](https://secapps.com/tools/scout) comes with a number of automated features to warn you about some common misconfiguration and security issues such as identified compromised accounts, vulnerable software versions, etc. However, it is best to have a look at the relationship graph as well to get an overall sense of the 3rd-party security posture.

![graph view](//images.ctfassets.net/qgz2s3egbmql/PCkmQl98ahMvvZQIJSlY9/eec739a6995176282e49823cbd4d3c29/image12.png?fm=webp)

The questions that we need to ask ourselves are whether it feels that the 3rd-party did enough to secure their public assets. Can we spot misconfigured Jira, Confluence, Jenkins and other types of services? Do we see unprotected API endpoints? Can we find unprotected database services? All of this information is part of the graph.

![graph screenshot view](//images.ctfassets.net/qgz2s3egbmql/6PcPOewdrca2qnIFVCzbDv/0e45628838d07ff0ead8e434b298c6d6/image5.png?fm=webp)

In this example, we can see that our 3rd-party vendor has both GitHub and TravisCI accounts. Perhaps they are leaking credentials as part of their builds? It depends how far you want to push it.

![graph view](//images.ctfassets.net/qgz2s3egbmql/5W2wkkwMxl4pqp8JPV6jDs/c7f42c30efd5606b6558d96a31b4ab09/image6.png?fm=webp)

A different part of the graph shows the various software types and versions currently in use. We can also see the most common HTTP response codes which could be indicative of abnormal behavior that should be flagged to our vendor.

![graph zooming options](//images.ctfassets.net/qgz2s3egbmql/7yS4d2ZCSgs5qGCIlkuKpV/e700e386bc572ed1105e7c660a590ca0/image10.png?fm=webp)

In order to get more details about each individual node, simply click on the "Toggle Inspector" button from the toolbar.

![fork](//images.ctfassets.net/qgz2s3egbmql/4rRW1ctsyXmADyXIe8MViZ/e3092d57b2f8af69a4f9139412de2eca/image4.png?fm=webp)

For even deeper analysis you can select a number of nodes and open them (a process known as "Fork") into Recon for manual investigation and further transformations. Follow the GitHub Gist Recon tutorial to find out how to extract GitHub user Gists which could contain some sensitive details such as API keys, passwords and much more.

![graph view](//images.ctfassets.net/qgz2s3egbmql/1r8uLhpKPmouIx4N7aj5Vu/99d30bda13e9e1185be13a165ff2c5c9/image11.png?fm=webp)

Pay attention to the screenshot above. The nodes that you can see are already compromised accounts for which there are passwords available on the DarkWeb. This, of course, is only here to demonstrate the risk and that particular 3rd-party has been notified and the risk remediated. Nevertheless, this is the kind of in-depth analysis we can perform to ensure that our business operates in a safe and secure environment.

## Automation

While we can do a lot through manual efforts, when we deal with 200-300 vendors at the same time, it is best to automate as much as possible. Once the vendor is configured, all we have to do is turn on the SecApps Scout scheduling options. You can run tests daily, weekly on a monthly schedule. It is recommended to use either weekly or monthly but there are some circumstances, which may require daily snapshots as well. For example, you might want to monitor a vendor which is particularly sensitive and of a big risk to you and your business.

![schedule](//images.ctfassets.net/qgz2s3egbmql/ZiRM5QqhCci8UwzEsQarC/33fe7c27794b46b2754e16fb037effc0/image1.png?fm=webp)

Once you define your schedule, you will receive a notification when change is detected, such as when new potentially vulnerable assets are identified. It is important to note that all of these tests are performed passively, without probing the 3rd-party's systems.

## Conclusion

In this tutorial, we explored a method of performing technical 3rd-party risk assessments without relying on a questionnaire. While questionnaires should be still at the core of the process in order to satisfy audit requirements and various types of certification, at the end of the day what matters whether the 3rd-party you are dealing with is, in fact, secure and does not possess a risk to you and your business. The only way this can be done is to identify all 3rd-party assets and map them such that analysis can be performed visually and the relationship between different threat models can be established.

This process can be automated fully with the help of [SecApps Scout](https://secapps.com/tools/scout).


To mitigate the exposure to 3rd-party risk, businesses must perform technical security due diligence.

recon graph

How to put supply chain attacks risk management on auto-pilot

3rd-Party Due Diligence

Cohesion is a state of the art web application security testing toolkit designed to be scripted, automated and used as part of a continuous delivery and continuous integration pipelines. In this tutorial we will discover how to install Cohesion and use it effectively to discover vulnerabilities with the scanner sub-command.

## Installation

Cohesion is published on npmjs.com as a package Nodejs module. For this reason you need to have node pre-installed in order to use Cohesion. Detailed instructions on how to install Nodejs can be found [here](https://nodejs.org/en/download/).

With Nodejs in readily available, Cohesion is just a short step away. Use npm to install: `npm install -g @secapps/cohesion`. Notice the `-g` option. This indicates that the tool will be installed globally.

![install cohesion](//images.ctfassets.net/qgz2s3egbmql/dkTfyD1D9f06JoAKJKo8Q/7407b2aca7a1167c71be0b32d334f35f/image3.png?fm=webp)

Alternatively you can add Cohesion as part of your local `package.json` file with the following command: `npm install -d @secapps/cohesion`. The `-d` flag indicates that the tool will be installed as a developer dependency. This method is most useful if you want to embed Cohesion and use it as part of your project dependencies. Keep in mind that your project does not need to be written in JavaScript and Nodejs.

There are other methods of installing and using Cohesion as well which we are not covering in this tutorial but they are worth mentioning. Due to the flexible nature of the installation process you can permanently install the package inside a specific Docker image for example. This image can be then used for all intents and purposes of this tutorial.

## The First Scan

Let’s start by performing a simple scan. The command we need is straightforward:

```bash
$ cohesion scanner http://target
```

![cohesion web security results](//images.ctfassets.net/qgz2s3egbmql/3XoT4wLDohXhhrGcHfLVNR/b78d641f6bc1d64ccad48b51d9c8ccae/image4.png?fm=webp)

We simply run the scanner and point it to the target. While this is an easy way to get started, you might want to customize the process. For example, let’s add an additional request header:

```bash
$ cohesion scanner -H ‘X-Testing: cohesion’ http://target
```

All requests are now going to contain the `X-Testing` header we set up above. You can use the same method to add cookies, specific authentication information and much more to your tests.

Alternatively, instead of starting with a target URL in the command-line, we can start with a full web request. Let’s create a file with the request and start the scanner.

```http
GET http://target/ HTTP/1.1
X-Testing: cohesion

```

And now let’s run this request via the scanner as we saw previously.

```bash
$ cohesion scanner test.request
```

In this example `test.request` is the file which contains the request we wrote above.

Explore the builtin documentation for more option flags and configuration options or consult with the cohesion online [manual](https://cohesion.sh/docs).

## Reporting

Although it is pretty useful to get the results directly in the output of the command, for most intents and purposes we need some kind of report deliverable. Luckily cohesion comes with a number of report exporting options. The most automation-friendly report is going to be JSON as it is easy to parse with tools like `jq`. But if you are interested in using the tool as part of the output of your merge requests in GitLab for example, you might want to consider using the junit reporting format as described in this [tutorial](https://cohesion.sh/docs/gitlab).

Here we are going to simply export the report as json.

```bash
$ cohesion scanner --export-json report.json test.request
```

That was easy! If you happen to use the tool interactively press the `r` key on your keyboard to get the current state of the report as the testing is in progress.

## Automation Options

Cohesion is most powerful when it is configured to be fully automated and for that we have created many [flags and options](https://cohesion.sh/docs/common-options). In fact, there are so many of them that it will be difficult to list all of them here but let’s use a few just to show their power.

In automated tests, we most likely want to exit the testing process as soon as a vulnerability is found. In other words we would like to break the build. The `--exit` option comes most useful in this scenario.

```bash
$ cohesion scanner --exit=">=8" test.request
```

In the example above the scanner will exit if it encounters a vulnerability that is level 8 or above. Such vulnerabilities are considered a critical risk and we should avoid publishing production applications and services in such a state at all cost. To learn more about the different levels use the info sub-command: `cohesion info levels`.

We can also use the `--wait` flag to ensure that the application we want to test is up and running before we start. This flag comes very handy to avoid writing glue code to run the scanner when the target application reaches a specific state.

```bash
$ cohesion scanner --wait=http://target/status http://target
```

In the example above we will wait for `http://target/status` to start returning `200 OK` status when requested. Only when we reach this state, the scanner will proceed executing.

Follow up with the [online documentation](https://cohesion.sh/docs) for more about available options and testing modes.


Cohesion is a state of the art web application security testing toolkit designed to be scripted

cohesion web security results

How to fully automate your web security testing pipeline with ease

Getting Started With Cohesion

Web archives (archive.org) and old cached content is an important trove of data for vulnerability research and bug hunting. Not only we can find some old endpoints that may not have been maintained as well as newer versions, but also they may contain sensitive information which at the time when the snapshot was taken it did not represent a big risk or the risk was not entirely known.

In this tutorial we will show you a very simple technique on how to find secrets across many web pages from various web archives and do so efficiently.

## Getting Pown

The first step is to get [Pownjs](https://pownjs.com) on your system. With Nodejs and NPM already installed, you simply need to run the following command:

```bash
$ npm install -g pown
```

This command will install Pownjs globally so that we can use it in future tutorials. Ensure that you upgrade frequently to get the latest patches and features especially for this tutorial. This is easily done with the following command:

```bash
$ pown update
```

## Exploring Pown Lau

[Pown Lau](https://github.com/pownjs/lau), part of the default distribution of Pownjs, is a library and a command line tool for listing old content from archive.org, commoncraw, and the alienvault indexes. The command has a pretty simple syntax. To list all archived URLs from secapps.com we need the following command:

```bash
$ pown lau secapps.com
```

![listing web archives](//images.ctfassets.net/qgz2s3egbmql/5KMlRATPPgyn74yoorVGRn/5bc7c1e33289963477ca6de3fae6d5db/image2.png?fm=webp)

You will notice that some of the URLs are duplicated. This is because they come from either different databases or different archive snapshots. The list can be cleaned up with either some shell scripting like this `pown lau secapps.com | sort | uniq` or you can use a builtin flag for that like this: `pown lau secapps.com -u`. Either way, you can use this list as the target for the next step.

## Finding Secrets with Pown Leaks

[Pown Leaks](https://github.com/pownjs/leaks), also part of the default distribution of Pownjs, is a secrets detection tool. It supports multiple mechanisms to search for strings that look like passwords, tokens and so on. The tool does this searching efficiently and it comes with its own community-supported database.

In the command line you can point the tool to either a directory for recursive search or a URL for fetching and searching within the content. For example, the following command will find the test harness leaks we have in the tool database:

```bash
$ pown leaks https://raw.githubusercontent.com/pownjs/pown-leaks/master/lib/db/aws.json
```

![pown leaks cli](//images.ctfassets.net/qgz2s3egbmql/4wy1TuEgbwGuYPfzuscqbJ/8abfa108c8a8aa13ac45e779dfe97014/image1.png?fm=webp)

## Combining Both Tools

Now that we know how to use each tool individually, let’s combine them both to search for leaks across many URLs extracted from the web archives. Our command is very simple:

```bash
$ pown lau secapps.com | pown leaks -u -s -
```

![using pown lau with leaks](//images.ctfassets.net/qgz2s3egbmql/308nXkrCb6EYl9GeqyiVIz/cb89082b7f5f9eb861015a6c71885557/image5.png?fm=webp)

As you can see, even our own domain contains things that look interesting and potentially require further exploration. Don’t worry, we are safe.

Let’s try this technique with a few more targets from popular bug bounty programs:

```bash
$ pown lau mail.ru | pown leaks -u -s -
```

![using the technique on mail.ru](//images.ctfassets.net/qgz2s3egbmql/dLMeRjY4xEAQEKG4zt9z3/7fc9aaa931be637ae16056fb637ecf8f/image3.png?fm=webp)

Here is another one:

```bash
pown lau uber.com | pown leaks -u -s -
```

![using the technique on uber](//images.ctfassets.net/qgz2s3egbmql/6nca6LcSKUtxCe73Yzib3j/d1f079ca8b50614838771fbd26d95432/image4.png?fm=webp)

For best results, you need to play with the command line options and to select a subset of the available leak detectors. As you may have noticed, some rules are too verbose and while often they can point to interesting areas of research, in some situations the noise may be too much for the task at hand.

## Conclusion

In this tutorial we have learned about `lau` and `leaks` two tools which come by default with Pownjs. Pownjs is the open source version of much of the technology we have built into the SecApps tools and services. By combining both tools you can hunt for secrets and leaks across many interesting URLs simultaneously.


In this tutorial we will show you a very simple technique on how to find secrets across many web pages

using pown lau with leaks

How to find leaks at scale with a few command line tools

Finding Secrets In Web Archives

At SecApps we pride ourselves on having one the most complete information security toolkit with fully-managed services and tools available directly from your very own browser. However, there are some tasks that can be better done with a bit of command-line magic.

In this tutorial we will explore two command-line tools available in our open-source PownJS security toolkit: travis and leaks. We will use the combination of both to quickly scan the target Travis CI logs and look for interesting information.

## Setup

Before we start, those of you who do not already have pown must install it with the node npm utility. If you don’t have Node.js, get it with your system package manager. Once node and npm are on your system (keep in mind you can simply use docker like this: docker run -it node /bin/bash) install pown with the following command: npm install -g pown.

If you happen to have pown already installed, ensure that you’ve got the latest version. This task is easily achieved by using the following command: pown update. Now we are ready to go.

## What is Travis CI

Travis CI is a popular continuous integration platform for open source projects with direct integration to GitHub. Developers are using Travis for all kinds of common activities, from building personal blogs to compiling libraries and more. Some tasks may require special setup to work. For example, deploying a blog may require some credentials for a Github, AWS S3 or some other type of account. These credentials are securely stored either in Travis itself or in the build configuration files as encrypted strings so that nobody can see them but the build scripts.

Although these secret strings are encrypted, it does not mean they are secure. In fact, just like any other build process, things can get very wrong. A debug trace dump could reveal vital information that was not exposed otherwise in the build file. Some environment variables may contain hints and in some cases actual passwords to production systems. Error messages and some other verbose logging can reveal access tokens. In order to discover all of them we need to download all travis logs and scan them. This is what we are doing next.

## Dumping The Travis CI Logs

The Travis CI build logs are available publicly for all open source projects. This means that we can easily retrieve them with nothing but a browser. However, some projects may hold hundreds of logs and so manually exploring them is just painful exercise which must be automated. Luckily, the pown toolkit contains one command that helps us automate this particular task easily.

To dump the logs of any Travis repository simply type the following: pown travis dump $ORG. In this example $ORG is the variable which holds the organisation name such as razor, roblox, or any other organisation that is, or has been using Travis CI in the past.

![git leaks travis ci](//images.ctfassets.net/qgz2s3egbmql/3Mh516Nt5HvXza05RZi2GA/c8ab8f04ac61e153570372980b2757b1/image1.png?fm=webp)

This step can take some time depending on the amount of logs. The tool will recursively dig into each individual repository associated with the target organisation and download the logs and the configuration files associated with each build step.

![download travis logs](//images.ctfassets.net/qgz2s3egbmql/4i2m3uNOvGUclpUhLF9tHG/33acc549a522a91875f78b82ef5cd9ed/image4.png?fm=webp)

You can see from the screenshot above that the logs can get pretty large. While 75 megabytes is not a lot of space, this is enough to fit about 120+ books as simple text files.

## Scanning For Secrets

Now that we have all logs downloaded locally, it is time to find secrets. This step is also fairly trivial if you have the right tools and so it happens that this is the case with the pown toolkit.

Pown Leaks is a command-line tool and a database of patterns that help you identify secrets: github tokens, AWS credentials, passwords and much more. You can support the secrets database directly on our GitHub [project](https://github.com/pownjs/leaks). Your changes will be incorporated into the next version of the pown toolkit.

Using the tool is straightforward: pown leaks. The location argument can be anything including a file, a directory or a URL. The last one is particularly interesting and we will explore in some other tutorial.

![dump travis ci](//images.ctfassets.net/qgz2s3egbmql/qAqPoCD0PvjyktpeQ1OdY/0a3d9113f2d924ddede3fbff5ab091ea/image2.png?fm=webp)

To start the hunt fire off the tool into the local directory where we dumped the Travis CI logs in the previous steps. Some particular flags you might want to use include \--unique and \--json. In this example we simply used the verbose flag which is suitable for demonstration purposes but with the additional flags we can really get interesting results quickly.

![pown leaks screen](//images.ctfassets.net/qgz2s3egbmql/7iybA3QozeTwqsOQBUzt68/b80fc4d3f7d6e2cabd9de976e46f798a/image5.png?fm=webp)

## Conclusion

In this tutorial we have learned how to dump the travis logs and search for secrets in two very quick steps everyone can follow and execute. With a bit of luck we can even find some interesting secrets the project owners have mistakenly leaked and therefore could potentially open the gates to other mischievous activities. You better rotate these secrets as soon as possible and follow up with a full audit on all systems affected.

Additionally, if you are interested to discover and continuously track secrets and other security deficiencies in build logs, source repositories and library modules across your entire developer estate, you might be interested to check out [SecApps Devcore](https://secapps.com/tools/devcore).


Quick tutorial how to find leaked API keys and credentials in TravisCI

Git Leaks Travis CI

How to find information leaks at scale with a few command line tools

Finding Secrets In Travis CI

Information Gathering, commonly referred to as Open Source Intelligence (OSINT), is a big part of any RedTeam activity, Bug Bounty Hunting and other types of security testing exercises. It is the first and perhaps the most important phase of a successful security engagement. Especially big, but often overlooked part of this phase, is finding leaked passwords and keys in GitHub Gists.

GitHub Gists are simple git projects. Most of these projects are made of a single file therefore often used as a means to share and remember useful information. Because of these properties, Gists can and often contain interesting information about the development practices of the target and sometimes useful information such as passwords, keys, and references to internal and external endpoints.

## Getting Started

Finding interesting Gists is not a task you would want to do manually. There are a lot of them and it can quickly get out of hand. You need specialist tooling. Tools such as [Recon](https://secapps.com/tools/recon) are particularly useful in such situations.

![image5](//images.ctfassets.net/qgz2s3egbmql/5ZuQqlb5PFKgKFlhoRpLQD/fb9248623356b54432aa4d9be5fa7333/image5.png?fm=webp)

In this tutorial, we will find the GitHub account associated with the target org, enumerate all members and find all their Gists in search of juicy information.

We begin by [launching Recon](https://recon.secapps.com&sa=D&ust=1593119046694000).

Once Recon is up, add a node by clicking on the PLUS (+) button and set its type to "brand" or "domain". Any type will do for this exercise. Recon is flexible enough to infer the context of the query.

Set the label to "github" for the target org and confirm. Start typing "github" in the inspector window (the screen on the right) under the transforms search section until you get a reduced list of compatible transforms matching the search query.

In this example, we have 3 compatible transforms and we just need the one that will enumerate the GitHub members. Click on "List GitHub Members" to complete the action. Use the popup properties to configure the transform to your needs.

![image8](//images.ctfassets.net/qgz2s3egbmql/34KAHzKcS6WMjcVeCEt07Z/960c65929d59f36f87fa728552fae14e/image8.png?fm=webp)

Now we have the graph populated by GitHub's GitHub Members, which not only embed links to profiles but also avatars and their nicks so that we know who is who. This information is particularly useful if we would like to expand the graph beyond the current task. More on this will follow in another tutorial.

![image3](//images.ctfassets.net/qgz2s3egbmql/2Y5SUjg8g1Hy4gpojDMdyq/900f35e07a826142f9b287e1cc81fb08/image3.png?fm=webp)

## Gist Analysis

Next, we pull the Gists. Select all GitHub members and click on the "List GitHub Gists" transform. This action will loop through the selected GitHub members, pull the Gists from their profiles and connect them with the relevant edges building the corresponding graph representation.

![image4](//images.ctfassets.net/qgz2s3egbmql/4uRVGlkPm3aCzGEH3F9u8j/1948012087cc702e12298bacd05d2ff8/image4.png?fm=webp)

Bigger nodes have more edges, i.e they carry bigger weight. This helps us identify what has more importance. Smaller nodes have lesser weight which is useful to find the needle in the haystack.

There are quite a few Gists in this example. To make them a bit more palatable simply select them all and click on one of the available layout transforms. The "Klay" transform often works the best at minimal performance costs.

![image6](//images.ctfassets.net/qgz2s3egbmql/4ieJ0NRuiQdYz3rOFmGN07/aadc33c547973c191ba6f58a410ceb3e/image6.png?fm=webp)

The output graph is slightly better and we can easily go through all the nodes by following all relevant links but undoubtedly it is difficult to perform this task at scale. Luckily for us, Recon contains a lot of transforms that can be used to help us solve this little problem. On such transform is the "Urlscan Liveshot" which will simply screenshot the pages and produce the relevant graph presentation. Let's do this quickly.

Select the Gists we want to screenshot. Find the "Urlscan Liveshot" transform and pull the trigger.

![image2](//images.ctfassets.net/qgz2s3egbmql/3eZKQ1INlgXQNuXeu5GxIB/888313af8dfda25d5905d404a73e7770/image2.png?fm=webp)

The resulting graph now contains all screenshots which we need for the review process. You can zoom in and out of the graph peaking at each individual image. You can have a bird-eye view as well which also helps to visually inspect the results. You can also navigate to the "Images" tab to scroll through all screenshot pages.

If you look close enough you will immediately notice leaks such as credentials, common bad development practices and other useful information which could potentially be leveraged in subsequent attacks.

![image7](//images.ctfassets.net/qgz2s3egbmql/7s9VNJW6UOirNKFje2Saxy/55e98fca92ba1156c30cadaf445f18be/image7.png?fm=webp)

While having screenshots of web pages are often the best way to scan through a lot of content with minimal effort, sometimes it is better to simply search for it. Navigate to the graph view and expand the filter section. Now we can simply search the graph labels for the information we need. The table will get filtered as we type.

![image1](//images.ctfassets.net/qgz2s3egbmql/686lKnBadSsG6zPzeuoGXJ/50a7bb4fd542cc2cd82f7bb6f0777878/image1.png?fm=webp)

## Conclusion

In this tutorial we explored a simple method for enumerating a GitHub organization, finding the members and locating their Gists revealing some interesting secrets in return. Now you can try to take this even further by expanding on some of the techniques learned here. Every hacker has their own way of going about OSINT so with practice and a bit of time you will develop your own methods and techniques.


Finding github gists for security research and more.

Security tutorials

3rd-Party Due Diligence

Getting Started With Cohesion

Finding Secrets In Web Archives

Finding Secrets In Travis CI

GitHub Gist Recon

Ready to get started?