# Internal Domain Admin Credentials Leaked in GitHub

In the month of march, I was learning bit more about github dorking. I was going through writeups, blogs, videos to learn about it. After spending some time, there was a itch inside me forcing me to try it in the real world target. Then I searched for the responsible disclosure program with the following google dork:

`site:com intext:reponsible disclosure`

I just randomly choose the target & started github dorking based on the given scope. After trying bunch of the following dorks:

`“`[`target.com`](http://target.com)`” password`

`“target” password`

`“`[`target.com`](http://target.com)`” path:env`

I just landed on the [var.tf](http://var.tf) file on the github. Navigating inside the file, I just found the domain admin username, password & the vsphere\_server IP address disclosed associated with the organization tld.

![](https://miro.medium.com/v2/resize:fit:700/1*foh2eMWCl38rVj8W1JM-Lw.png align="center")

Since , I realized the credentials are used inside the organization infrastructure & also without the strong evidence that the github repository belong to the organization employee it’s a baby-cry thing in the bug-bounty. Also, reading their responsible disclosure it was clearly mentioned that actively auditing their infrastructure based on the credentials found on the internet is strictly prohibited.

Anyway, I decided to report it anyway. After, some days they just reply with this.

![](https://miro.medium.com/v2/resize:fit:700/1*Re3gUrLGA0XvmFsKJYVZBQ.png align="center")

I just accepted the invitation & proceed further.Some days later, a hackerone triager replied that the repo doesn’t belong to the organization and If I managed to provide the proof, they will proceed further.

![](https://miro.medium.com/v2/resize:fit:700/1*nkPyFvcWYW12QlECPhu_hg.png align="center")

I just left it right there after reading the reply. Next day from this reply, I received another message.The report was triaged with the medium severity. Now , long story short on the march 21st they fixed the issue removing the github repo & closed the report as Resolved.

![](https://miro.medium.com/v2/resize:fit:700/1*ARSYcfASTvYZTigYIMH1Sg.png align="center")

Although , it was VDP but the experience was quite good. At last, I just want to put some resources below to learn the github dorking.

* [https://orwaatyat.medium.com/your-full-map-to-github-recon-and-leaks-exposure-860c37ca2c82](https://orwaatyat.medium.com/your-full-map-to-github-recon-and-leaks-exposure-860c37ca2c82)
    
* [https://youtu.be/L0-aa60CZuI](https://youtu.be/L0-aa60CZuI)
    
* [https://github.com/techgaun/github-dorks](https://github.com/techgaun/github-dorks)
    
* [https://gist.github.com/jhaddix/2a08178b94e2fb37ca2bb47b25bcaed1](https://gist.github.com/jhaddix/2a08178b94e2fb37ca2bb47b25bcaed1)
    

Thank you everyone.