How I Made From Deleted Files — A Bug Bounty Story

TL;DR — I built an automation that cloned and scanned tens of thousands of public GitHub repos for leaked secrets. For each repository, I restored deleted files, found dangling blobs, and unpacked .pack files to search for exposed API keys, tokens, and credentials. Ended up reporting a bunch of leaks and pulled in around $64k from bug bounties.

Read the full article here

You Should Know: Key Techniques & Commands

1. Cloning GitHub Repositories

To automate cloning multiple repositories, use:

git clone <repository_url> 
 For bulk cloning (using a list of repos) 
while read repo; do git clone "https://github.com/$repo"; done < repos_list.txt

2. Restoring Deleted Files in Git

Git retains deleted files in its object database. To recover them:

 Find dangling blobs (deleted files) 
git fsck --lost-found 
 Check content of a dangling blob 
git show <blob_hash>

3. Extracting Secrets from Git History

Search entire commit history for sensitive data:

git log -p | grep -i "api_key|password|token|secret"

4. Unpacking Git Pack Files

Git stores objects in `.pack` files. Extract them using:

 List objects in a pack file 
git verify-pack -v .git/objects/pack/pack-.idx 
 Extract specific object 
git show <object_hash>

5. Automating Secret Scanning

Use tools like TruffleHog or Gitleaks:

 Install Gitleaks 
brew install gitleaks 
 Scan a repository 
gitleaks detect --source=<repo_path> --report=<output_file>

6. Checking for Leaked AWS Keys

Validate AWS keys using the AWS CLI:

aws sts get-caller-identity --profile <leaked_key_profile>

7. Reporting to Bug Bounty Programs

HackerOne: `h1 report create` (CLI)
Bugcrowd: Submit via dashboard
GitHub Security: Report via GitHub Security Lab

What Undercode Say

This story highlights the importance of proper Git hygiene and secret management. Many developers assume deleting files removes them permanently, but Git’s design retains data unless explicitly purged.

Key Takeaways for Security Researchers:

Always scan `.git/objects` for lingering secrets.
Use `git gc –prune=now` to permanently erase unreachable objects.
Monitor GitHub leaks using automated scanners.
Participate in bug bounty programs (AWS, GitHub, Google, etc.).

For Developers:

Use `.gitignore` to exclude sensitive files.
Rotate exposed keys immediately.

Pre-commit hooks can block secrets:

Example pre-commit hook (using Gitleaks) 
gitleaks protect --staged

Expected Output:

A systematic approach to uncovering and reporting leaked secrets can yield significant bug bounty rewards. Automation, Git forensics, and persistent scanning are key.