I Found Your Github Secrets

[@devKazuto]

That's why it's a good idea to squash your pull/merge requests. As long as a secret is not merged in a branch the history of adding and removing a secret will be lost.

[@qwltr]

Found this channel recently - extremely good content, keep going.

[@bakaryk2435]

Thanks for sharing John! especially the first method with bash

[@angryyardie1284]

Another way this could be done, in particular with repositories with larger numbers of commits is to make use of git bisect. Using git bisect, you can binary search your way to find the commit that you're looking for by setting the start to the first commit and the end as the HEAD. With that, you can create a script that returns say 1 when no secret is found and 0 when it is found and terminate your search the first time your script returns 0

[@AUBCodeII]

binary search > sequential search

[@inx1819]

9:40 im curious is there any vulnerability here or is it just a random piece of code

[@alexandrucomanescu9857]

Same.

[@dom1310df]

FYI PyPI is pronounced pie-pee-eye, to avoid confusion with PyPy (the JIT version of Python)

[@jpineda79]

hi John, make a setup tutorial for Kali Purple please and your thoughts of it.

[@energy-tunes]

Please more of this

[@vipuldawar88]

How do fix the git history in such cases? What are steps to prevent such attacks?

[@vipuldawar88]

@Arnav Vijaywargiya who does that? That’s insane

[@nordgaren2358]

Maybe when you are merging the commit with sensitive info, you can squash the commit with others to be a single commit?

[@logiciananimal]

@Arnav Vijaywargiya That's sadly often correct.

[@davidt01]

Rotate the token if possible.

[@dack42]

You can modify the history with tools like "git filter-repo" or BFG repo cleaner.

[@nav34d]

Do you like it thicc or you do you like it drip

[@thebush6077]

Thicc

[@laneprokopp9746]

The kind you drink

[@declanmcardle]

@13:27 grep -Ev 'pattern1|pattern2' instead of grep -v | grep -v | grep -v ...

[@ejonesss]

couldnt you just download all the commits as separate text files and do a search for the string on all the files?

[@dotconnector3889]

Awesome!

[@tyrojames9937]

NICE.

[@RealCyberCrime]

I’m thinking about making a similar video on how hackers leverage GitHub!

[@nordgaren2358]

You post this on every video... o.0

[@FreshRex]

Do it i will sub now

[@MelroyvandenBerg]

great!

[@serkhetreo2489]

true

[@DarkFaken]

Love you ❤️

[@davidmckee533]

BAD John Hammond Bad

[@v.s.spavanakasinadhasarmaswaya]

pico CTF event has been started any suggisitions please

[@ХалидДрис]

this is considered easter egg ? XD

[@Vvengance]

Are you Red?

[@arnoeagleeyes]

Wow, i am learning so much stuff from this series that i can use in my daily work as a programmer. Thank you for that.

[@CybersFutures]

Hacking tools video please to showcase some cool hacking tools

[@MrHasooooni]

your channel is just an awesome learning journey by itslef man keep up the good work much love

[@tbrew5265]

🤝 firm handshakes, John. I appreciate your guidance and wisdom.

[@rajeshsagar3912]

great explanation, thank you

[@LostInTheRush]

Hey John. I really like your content, so don't take this the wrong way. I've been wondering why I regularly have trouble focusing throughout your videos, and I think I've come to the conclusion that it's because you speak very "loudly" (not in amplitude obviously, but in articulation), which when listening for longer periods of time, can become quite mentally tiring. A bit like being yelled at for 17 minutes. Not sure if it's just my neurodivergent ass, but I thought I'd mention it. I mean, I assume you compress the audio as well to increase loudness, and if people need it louder, they can just increase the volume. I am 100% sure people will still find your videos interesting and engaging with a little less power on the speak. Keep up the great work though!

[@secinject814]

I can see what you mean, he does speak quite loudly, and quite fast as well. Even for a native speaker like me it definitely takes me focus to not only process everything he is saying but just keep up. But I'd take that over mumbling, quiet channels who speak at a snail's pace. *And really, we as viewers have the power to control our volume, and our viewing speed as well*. So honestly I'd rather him just feel comfortable explaining topics at his own pace, and in his own style. We should be happy to have him at all. The guy is a goldmine of amazing teaching, instruction and enthusiasm. A real breath of fresh air amongst all those god-forsaken cursed videos... the ones with loud and terrible trance/electronic music, no narration to describe what's going on, and any information needed to be given out is literally typed out on notepad, like what in the actual f**k.. I despise those videos, they really boil my blood lol. So John will always be in my top 10 of cyber-sec teachers in my book. He's intelligent, highly experienced and certified, enthusiastic to teach others, and puts great effort into making his videos well-made and informative. So hats off to John, much, much love to ya.

[@AUBCodeII]

He speaks like a sigma male

[@antonpetrov145]

I am curious what can you do with the pypi password?

[@dustinhxc]

That was amazing! I was curious how to do the GIT bug bounties. Obviously won’t find anything, but good to see in action. Thank you!

[@mr.unforgettable]

Hey John, very recently I have seen a new method of KZbin scam for cracked software which involves AI. Perhaps you should investigate this whether it is using the same info stealer malware or whether it is some mutated or new type. I was made aware of this by a muthahar which droped today.

[@Stopinvadingmyhardware]

I would have told you that there's nothing in there, you didn't have to steal accesss.

[@illusionsingh]

Oscp changes 2023 I want new video

[@debrabest5035]

THANK YOU SO MUCH!!!!!!! INTERESTING, AND INFORMATIVE!!!!!!! AGAIN, THANK YOU, AND, BE BLESSED❤️🙏

[@kevinalexander4959]

stop yelling its too early

[@debrabest5035]

I'M NOT YELLING SIR I HAVE BAD VISION, SO TYPING IN UPPERCASE, IS EASIER FOR ME TO SEE!!!!!!!! HOWEVER, BEING THAT THIS TROUBLES YOU, I WILL NOT REPLY, NOR VIEW YOUR VIDEOS AGAIN!!!!!!! BE BLESSED❤️🙏

[@nordgaren2358]

@@debrabest5035 That wasn't John who replied to you, it was just a random user. No need to boycott Johns videos because of a random user!

[@kevinalexander4959]

@@nordgaren2358 lmao

[@kevinalexander4959]

@@debrabest5035 wow for not being able to see well without CAPS LOCKKKKK you sure have no issues clicking small emoticons.

[@Hackanhacker]

HOW REFRESHING TO NOT HAVE A COMMON SPONSOR THAT DOESNT FIT THE CHANNEL WOW LOL

[@tigreonice2339]

So... how to prevent that? 😅 Omg 😮

[@bronxandbrenx]

Thank you master John

[@Naath000]

loved your all videos

[@axer552]

Hello

[@martinmiosga9517]

Hello, what do I do if I forgot the password to Kali?

[@TCKRDefense]

use a password manager. or take a screenshot of the password and save it in a cloud .

[@AcezeroGame]

404th viewer, very lucky day for me😊

[@vladventura1928]

Really? I couldn't find you 🤔🤣

[@UncleReals]

thanks for ruining this now I won't be making money anymore

[@CZghost]

Isn't it reupload?

[@zdzisawdyrma3319]

:)

[@thebush6077]

3 min gang

[@fqoffgoogleurcr33py]

So many ads

[@DS6Prophet]

Use adblocker! I only turn it off for specific KZbinrs, so they get to make their earnings. Not for everyone though.

[@declanmcardle]

@8:20 export PAGER=none

[@tollsimyfpv]

BFG-repo-cleaner can be used to remove secrets from a git repo