Hackers Use Github For Malware

[@_JohnHammond]

To clarify, with the comments upload drag-and-drop trick, you can't upload any file extensions outside of this allowlist (i,e., executable files not allowed): GIF, JPEG, JPG, MOV, MP4, PNG, SVG, WEBM, CPUPROFILE, CSV, DMP, DOCX, FODG, FODP, FODS, FODT, GZ, JSON, JSONC, LOG, MD, ODF, ODG, ODP, ODS, ODT, PATCH, PDF, PPTX, TGZ, TXT, XLS, XLSX or ZIP. Nothing stopping you from putting things in a release asset, though 😜 That trick looks to be doable on Gitlab just as well.

[@tomashublik5586]

6hrs ago wtf

[@blinking_dodo]

I hope you have properly reset your GitHub session... 😅

[@nordgaren2358]

@@tomashublik5586 Video gets uploaded the day prior for scheduling. Can comment on it as much as you want, until then.

[@xanderplayz3446]

Or just put an EXE in a password-protected zip and make a project with an issue, which you report on an alt, with logs in a zip, which has a password, and you fake a conversation between you and the alt, saying that it has a password, and then the alt sends real logs in a zip; There would be no evidence of malicious intent.

[@us_f4rmer]

That´s an social engineer's wet dream. But the fact it works w/out even posting the issue is really the icing of the cake!

[@archlinuxsys]

this is why i love john. he's so passionate and eager to share!

[@idontexist-satoshi]

No, he technically has a 'business' to run, i.e., his KZbin channel. He posts what he knows will generate clicks while also using his skills.

[@BillAnt]

@@idontexist-satoshi - While providing clear info understandable by most folks.

[@creeperfun12]

@@idontexist-satoshi so your saying he doesnt enjoy his job

[@discocat2500]

The issues-based file hosting is wild. You would think a person would at least need to submit the issue to have their files stored on a server for any length of time. I wonder how long those links are valid.

[@dothex]

I see you changed the title of the video and thumbnail with the quickness.. I'm guessing "How to use Github to hack" wasn't as viable as you thought :D

[@patrickslomian7423]

Python Selenium would be a simple solution. Imitate a web browser, "upload" your file, get the url and send it to the c2 server / client .

[@vaisakh_km]

We can detect Hearless selenium's presence easly with cpu spike... 😂 but in windows it's doesn't make a dent, so it's fine but linux user would easly find it

[@BluescreenDev]

Would Not be. Its detected.

[@patrickslomian7423]

@@BluescreenDev Have you tried to run the script over a proxy ?

[@wrathofainz]

That would be great if websites weren't able to detect things like selenium and chrome driver. Js and the dev tools are to blame. The people making browsers just aren't hardening them against developer tools being detected, so a site can refuse to work if you open it in selenium or even open the dev tools (like aniwave or 9anime)

[@exploittutorial8689]

I was once following your tutorial on burpsuite and I downloaded foxy-proxy extension on my Linux machine. Whenever I tried to use terminal as sudo the terminal freezed. I cannot recall the exact extension developer but clearly it was some variation of foxy-proxy. I uninstalled the extension and the terminal worked again. You should do a video on this

[@Bluegeneral05]

Dude, this is awesome, great video!

[@yalekthelembine0391]

Why does the Linux community ignore this? Especially Linus Torvalds? Because they're also hackers. And by the way RMS, hacker is also ambiguous . Hacking is also dangerous because of its black hat definition.

[@wtfdoiputhere]

who would've thought 😱

[@mentor_bajrami]

I keep reporting github malwares on a daily basis

[@smnomad9276]

Thanks for your service man. This is the essence of open source, we need more people like you.

[@じゅげむ-s6b]

10:14 I love that that's the video, idk it's hilarious

[@xpower7125]

github is the new discord (kind of)

[@Leadshot]

So i am currently doing a cyber security course and theres a project coming up where we have to setup a metaspoiltable 2 box.. could anyone tell me some tools to use to pentest the box if i am on team red and or some tools to defend the box etc on team blue? Would i need to have python knowledge as i am very new to it and i am starting to dip my toes in it

[@ronaldosd]

Lol, Microsoft is still using AWS for Github and not Azure 😂😂

[@kcnl2522]

Migration is a pain on the ass even for msft

[@cringesh1t427]

@@kcnl2522so are Russian hackers

[@wrathofainz]

I can imagine having a command of some sort in a file hosted on github and malware hosted on a device which occasionally checks that repo for a commit to that file, or perhaps a comment in a reply chain or something... I was specifically thinking that your command & control changes a file on the repo and at some point the malware will pull that file (during a poll :P) and do the command like taking a screenshot and uploading it back to the repo. Idk Very interesting video. I'm already using github to share memes, but now I'm getting ideas about how I can use other sites I'd otherwise never touch, like Truth Social.

[@zanidd]

You forgot my kind of hackers: the ugly

[@emc2847]

Hi John, great video. How can I connect with you about learning more.

[@VaibhavShewale]

well that was a fun until it lasted!

[@mattd1957]

Hay John, I hope you're doing well, so I'm trying to find a websites Directory with Linux like Ubuntu, but I'm not sure how, can you make a video on how to find a websites directory please Thanks. 😊

[@anselmoarantes]

When I Saw the title, what came to my mind was "Who Doesn't?"....

[@zanidd]

Keep'er Security? I hardly know her!

[@pliusleft]

discord was so much easier before they made the fix

[@kcnl2522]

You are talking about the cdn links ye?

[@zcavaleiro]

Looks like web 1.0

[@dademurphy6123]

Are you Seth Rogens brother?

[@c.n.crowther438]

Seth Rogan sounding breh

[@cyber_space09]

Okay Sir that's what i want to do 🤣📈🚩

[@rupeshsah-l7c]

love from nepal

[@じゅげむ-s6b]

I thought it was gonna be the zoo

[@amethystix_]

there hasnt been a comment in six months

[@wrathofainz]

Lmao, this totally works 😂

[@iamwitchergeraltofrivia9670]

Hahahhhhhhahahh so many malware

[@IlIIllIlIlIIlIlIlIlIIl]

.

[@endoxidev]

dang just 4 minutes and I'm already here

[@arunprakash2426]

❤

[@carsonjamesiv2512]

😀👍

[@abdallamohamed5844]

Wow

[@ChristmasTvGames]

8th comment here

[@zwanski.m]

I've been a follower since 2018 but he never response to my comment 😂

[@insomniac-afk]

no one gives a fucking shit

[@hollywoodhank591]

First!!!

[@tomashublik5586]

nope

[@uncleburu9464]

First

[@tomashublik5586]

L, I am first

[@tomashublik5586]

first