Hey guys, it’s me @dheerajydv19, and recently while using Twitter, I came across some new techniques i.e how can we find a GitHub user’s email?
Let’s learn this process step by step -
- Open the GitHub profile of your victim(user)
For example, my profile is at https://github.com/dheerajydv19
- Open any of his repositories.
- As you can see code is written in green color, just below that there will be a displayed number of commits in that particular repository.
Click theirs.
- You will be shown a list of all commits, open any one commit that is done via the victim.
- Now the URL would have been something like the below
github.com/dheerajydv19/Test-Direct/commit/***********************
- Just add .patch and the end of the URL
github.com/dheerajydv19/Test-Direct/commit/**********************.patch
- Congo, if you would be lucky you will see the real mail id of the victim, if you are unlucky you will see a mail id like *****+username@noreply.github.com
Here in some cases, you will see the actual main while in others, you will see the mail in the format I stated above.
But Why?
The logic behind this is that GitHub itself provides a feature that if someone doesn’t want to make their emails visible, they can set an option in their GitHub profile settings and so if someone is using that option, you won’t be able to get their actual mail and if someone’s not using it, you will be able to find their actual mail.
Something New - Since this trick is solemnly based on the fact that the commit is leaking the mail id so if someone doesn’t have any public profile, you can still use this trick as you have to just find any commit that is done by your victim, and that’s easy.
(Most of the researchers missed this point since most of them just copy pasted that but you know your brother thinks differently)
Here is the step-by-step procedure -
- Open the GitHub profile of your victim.
- Pay close attention to the contribution activity section, you can see all the commits done by the victim even those which he has done in other repo.
3 Just after the GitHub repo name, where the victim has done the victims, there will be a number of commits, click there.
- Now, you will be able to see the list of commits, open the commit done by the victim, add .patch at the end of the URL, and congo.
(You can use the graph showing the yearly streak too instead of contribution activity)
On the contrary, in order to find out whether this or that mail is involved in a GitHub account, use the following tags in the GitHub search string:
committer-email:ivan@site.com
author-email:ivan@site.com
(This tip is by @ibederov_en)
That’s it for today, many more amazing writeups coming soon related to osint and bug hunting, only on hacklido.
Follow me on Twitter: https://twitter.com/Dheerajydv19
