Alessandro Fogli Iseppe iseppe

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

Chat GPT "DAN" (and other "Jailbreaks")

Managing SSH keys for Github and Gitlab

NOTICE: This guide will help you set ssh keys for GitHub and GitLab. However, this is not going to change your commit user.name or user.email. If you need to change those for specific repositories, just run the following commands while in your repository:

git config user.name "Your Name Here"
git config user.email [email protected]

For more info, see this answer. Also, keep in mind this only changes the .git folder inside your repository which never gets added/committed/pushed/uploaded.

I recently had to manage two ssh keys (one for Github and one for Gitlab). I did some research to find the best solution. I am justing putting the pieces together here.

Reset Forgotten Raspberry Pi Password

Remove SD Card

The first step is to turn off the Raspberry so you can remove the memory card without worry.

If the Raspberry Pi is not connected to a screen, the only way to turn it off is to unplug it. Otherwise, you can go through the GUI to turn it off properly, via the menu, before unplugging it.

Once the Raspberry Pi is turned off, you can insert the card into your computer and go to the next step.

Google dork cheatsheet

Search filters

Filter	Description	Example
allintext	Searches for occurrences of all the keywords given.	`allintext:"keyword"`
intext	Searches for the occurrences of keywords all at once or one at a time.	`intext:"keyword"`
inurl	Searches for a URL matching one of the keywords.	`inurl:"keyword"`
allinurl	Searches for a URL matching all the keywords in the query.	`allinurl:"keyword"`
intitle	Searches for occurrences of keywords in title all or one.	`intitle:"keyword"`

Content

Basics
Disk and File System Management
- General Disk Manipulation (non-LVM)
LVM

PSQL

Magic words:

psql -U postgres

Some interesting flags (to see all, use -h or --help depending on your psql version):

-E: will describe the underlaying queries of the \ commands (cool for learning!)
-l: psql will list all databases and then exit (useful if the user you connect with doesn't has a default database, like at AWS RDS)

	// ==UserScript==
	// @name Tinder Deblur
	// @namespace Violentmonkey Scripts
	// @match https://tinder.com/*
	// @grant none
	// @version 1.4
	// @author Tajnymag
	// @downloadURL https://raw.githubusercontent.com/tajnymag/tinder-deblur/main/tinder.user.js
	// @description Simple script using the official Tinder API to get clean photos of the users who liked you
	// ==/UserScript==

	Hi All!

	I've recently launched a tool that wraps many of the commands here with a user interface. This desktop application is currently available for macOS. There's a roadmap outlining planned features for the near future.
	Feel free to request any features you'd like to see, and I'll prioritize them accordingly.
	One of the most important aspects of this application is that every command executed behind the scenes is displayed in a special log section. This allows you to see exactly what’s happening and learn from it.

	Here's the link to the repository: https://github.com/Pulimet/ADBugger

	App Description:
	ADBugger is a desktop tool designed for debugging and QA of Android devices and emulators. It simplifies testing, debugging, and performance analysis by offering device management, automated testing, log analysis, and remote control capabilities. This ensures smooth app performance across various setups.