Hacking using search, inattention and my accomplice GitHub
the
Introduction
One fine, bright morning, being shocked from what the temperature outside, as it seemed, was 5 degrees more than usual, I felt an unprecedented influx of light and my brain had crept the idea — "but those offers and accounts, which are sold on the "black market" — these are stolen all kinds of phishing sites and the Steelers, and as far as I know, the Steelers — all logs must be stored on the Kaoma-host on the Internet".
From that moment there was no time to hesitate — you need to test. I headlong ran to the computer frantically hammering in the address bar "google.com" and first entered the search query "stealer filetype:txt". Seen I'm not how much surprised among the search queries I saw the expected logs of one of the most popular Steelers.
View screenshot
the
Chapter 1. Why you need to use robots.txt the nofollow tags and put plugs
After that I couldn't stop. I, like a wolf that smelled blood of his victim continued to search, but with the queries that are more targeted for specific names Steelers
screenshot #1
screenshot #2
And then struck me again — "but apart from logs with accounts of failed users caught in the "software thief", you can find something more serious, such as configs" and I went on GitHub.
the
Chapter 2. Why you need to block files via configs .gitignore
Frankly, the opportunity to do what I did and see what I saw I was due to the carelessness or laziness of some users who prefer to use GitHub instead of the alternative services that allows you to create private repositories (networks, bitbucket).
Take, for example, the mask automatically generated by MYSQL host one of the popular hosting and get, again, expected result:
View screenshot
No further need to have a lot of imagination to understand what to do with all this.
the
Conclusion
Please use file .gitignore not Deplete your configs.
Комментарии
Отправить комментарий