Re: Public VCS security issues

[Ronald <mini.pelle () gmail com>]

beautiful list of blank passwords for unused applications.


On Wed, Mar 26, 2014 at 7:01 PM, Jeremy Voorhis <jvoorhis () gmail com> wrote:

> There are lots of AWS credentials out there as well:
> https://github.com/search?q=AKIAJ&type=Code&ref=searchresults
>
>
> On Wed, Mar 26, 2014 at 8:18 AM, Patrik asd <patrik.grinsvall () gmail com
> > wrote:
>
> > Probably old but still an issue:
> > https://github.com/search?q=mysql.binero.se&ref=cmdform&type=Code
> >
> > The first hit gives you access to phpmyadmin.
> >
> > There are TONS of credentials pushed to public repositories. This query
> > gives 57k results:
> https://github.com/search?q=define%28%22DB_PASSWORD%22&type=Code&ref=searchresults
> > It's easy to prevent from a developers perspective, but still - there are
> > probably hundreds of thousands of database or other credentials pushed to
> > public repos.
> >
> > _______________________________________________
> > Sent through the Full Disclosure mailing list
> > http://nmap.org/mailman/listinfo/fulldisclosure
> > Web Archives & RSS: http://seclists.org/fulldisclosure/
>
>
>
> --
> Jeremy Voorhis
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/