Listen to this Post
Introduction:
The accidental exposure of GitHub tokens and SSH keys remains a significant attack vector, potentially granting attackers unauthorized access to proprietary code and sensitive infrastructure. The release of GH Navigator, alongside the existing KeyChecker tool, provides security professionals with a comprehensive suite to assess both data-plane and control-plane risks associated with these leaked credentials. This article will guide you through the practical use of these tools to map access and understand the blast radius of a compromised token.
Learning Objectives:
- Understand the difference between data-plane (SSH keys) and control-plane (API tokens) exposure on GitHub.
- Learn to use GH Navigator’s GUI to navigate repositories without cloning them locally.
- Master the process of validating single or multiple GitHub tokens to map repository permissions and assess risk.
You Should Know:
1. Installing GH Navigator and KeyChecker
The tools are hosted on GitHub and can be cloned directly. This is the first step in setting up your assessment environment.
Clone the GH Navigator repository git clone https://github.com/cyfinoid/gh-navigator.git cd gh-navigator Clone the KeyChecker repository for SSH key analysis git clone https://github.com/cyfinoid/keychecker.git cd keychecker Install Python dependencies for both tools pip3 install -r requirements.txt
This set of commands establishes your local testing environment. The `git clone` command downloads the latest code from the repositories, and `pip3 install` ensures all necessary Python libraries, such as `requests` for API calls and `tkinter` for the GUI, are installed.
- Validating a Single GitHub Token with GH Navigator Token Validator
Before navigating, validate what a token can access. The Token Validator module provides a quick permissions audit.Run the token validator against a single token stored in an environment variable python3 gh_navigator_validator.py --token $GITHUB_TOKEN Alternatively, pass the token directly (not recommended for security) python3 gh_navigator_validator.py --token ghp_yourTokenHere
This script queries the GitHub API to list all repositories accessible by the provided token. It categorizes them by permission level (read, write, admin), giving you an immediate overview of the token’s “control-plane” scope and the associated risk level.
3. Bulk Token Validation for Incident Response
In a breach scenario, you may have multiple tokens to check. The validator supports bulk analysis from a file.
Create a file (tokens.txt) with one token per line echo "ghp_token1" > tokens.txt echo "ghp_token2" >> tokens.txt Run the validator in bulk mode python3 gh_navigator_validator.py --file tokens.txt
The tool will iterate through each token, outputting a consolidated report. This is critical for understanding the aggregate exposure if several developer tokens are leaked, allowing for rapid prioritization of token revocation.
- Launching the GH Navigator GUI for Repository Exploration
The GUI module allows you to browse accessible repositories interactively, mimicking the GitHub web interface without requiring a local clone.Launch the GH Navigator GUI python3 gh_navigator_gui.py
Upon execution, a window will open prompting you for a GitHub token. Once authenticated, the interface will display a list of repositories you have access to. You can click through directories and view file contents directly. This is invaluable for a forensics exercise to determine exactly what source code an exposed token can reach.
-
Assessing Data-Plane Risk with KeyChecker for SSH Keys
While GH Navigator handles tokens, KeyChecker automates the validation of SSH keys against GitHub to identify data-plane exposure.Validate a single SSH private key python3 keychecker.py -k ~/.ssh/id_rsa Validate a list of keys from a file python3 keychecker.py -f found_keys.txt
KeyChecker attempts to authenticate to GitHub using each provided SSH key. A successful authentication indicates that the key is still active and associated with an account, representing a direct “data-plane” risk for code cloning and pushing.
6. Integrating with GitHub API for Advanced Enumeration
For automation, you can directly use the GitHub API with a valid token to extract similar information. This is what the tools do under the hood.
Use curl to list accessible repositories for the authenticated user/token curl -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" https://api.github.com/user/repos?per_page=100 Query a specific user's public repositories curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/users/username/repos
These `curl` commands demonstrate the core API interactions. The first command lists repositories accessible to the token, while the second can be used to gather intelligence on a target. Understanding these commands helps you customize scripts for specific assessment needs.
7. Mitigating Exposed Token Risks: The Immediate Response
Discovery is only half the battle. Once a exposed token is identified, immediate action is required.
Revoke a compromised GitHub token using the API (you need an admin token or the token itself) curl -X DELETE -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" https://api.github.com/applications/CLIENT_ID/tokens/TOKEN_ID Alternatively, revoke all tokens for an application (drastic but thorough) curl -X DELETE -H "Authorization: Basic <code>echo -n "CLIENT_ID:CLIENT_SECRET" | base64</code>" -H "Accept: application/vnd.github.v3+json" https://api.github.com/applications/CLIENT_ID/tokens
These commands are for automated revocation. The first deletes a specific token, while the second revokes all tokens issued for a specific GitHub OAuth application. This should be part of an incident response playbook following the discovery of a leak.
What Undercode Say:
- Control-Plane vs. Data-Plane Clarity: The distinction made by these tools is crucial. GH Navigator (tokens) assesses what you can manage and access via the API (control-plane), while KeyChecker (SSH keys) assesses what code you can clone and modify (data-plane). A full risk assessment requires both.
- The Power of Automation in Exposure Assessment: Manually checking tokens or keys is impractical at scale. These tools transform a tedious, error-prone process into a rapid, repeatable operation, which is essential for effective vulnerability management and incident response.
The release of GH Navigator and the promotion of KeyChecker represent a maturation of the tools available for external attack surface management. By focusing specifically on GitHub credentials, Cyfinoid Research has addressed a very common and high-impact problem. The GUI component of GH Navigator is particularly insightful, as it lowers the barrier to entry for less technical stakeholders to understand the scope of a leak. However, the true value lies in the combination of tools, providing a 360-degree view of credential exposure. This approach moves beyond simple detection to actionable intelligence, enabling teams to not just find problems but to understand and prioritize their remediation effectively. In an era where source code is a crown jewel, such tools are becoming indispensable.
Prediction:
The sophistication of tools like GH Navigator will force a shift in how organizations manage their secrets. We will see a move towards more automated, continuous secrets detection integrated directly into CI/CD pipelines, not just as a reactive measure post-leak. Furthermore, as attackers increasingly weaponize such tools for reconnaissance, expect GitHub and other platforms to enhance their anomaly detection, identifying bulk API requests from tools like these as potential threat actor behavior, leading to a new cat-and-mouse game in credential scanning and protection.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Anantshri Gh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
