4 ms·

Osgint – OSINT tool to find information about GitHub user

116 points by CHEF-KOCH 2y ago

cpursley 2y ago
That's basically the idea behind https://reporeach.com https://reporeach.com
- numinix 2y ago
  How can you tell? This website doesn't explain what the product is, how it works, or even bother with a privacy policy.
  - confiq 2y ago
    It also requires registration to use it.
- dustyharddrive 2y ago
  This looks very GDPR compliant!
zellyn 2y ago
[+] login : zellyn [+] id : 33625 [+] avatar_url : https://avatars.githubusercontent.com/u/33625?v=4 [+] name : Zellyn Hunter [+] company : Square [+] blog : http://www.zellyn.com/ [+] location : Atlanta [+] bio : Programmer at Square. Mostly (currently) Go. [+] public_repos : 52 [+] public_gists : 47 [+] followers : 101 [+] following : 20 [+] created_at : 2008-11-10T13:26:38Z [+] updated_at : 2025-03-03T00:51:46Z [+] public_gists : https://gist.github.com/zellyn [+] SSH_keys : https:/github.com/zellyn.keys [+] email : hippytrail@gmail.com zellyn@squareup.com tomcw@users.noreply.github.com zellyn@gmail.com Pretty much spot on, except for the emails. The ones with username `zellyn` are correct; the others are people who've contributed changes to repos I created (I think).
Dotnaught 2y ago
Seems like its more trouble than just appending .patch to a commit.
theyknowitsxmas 2y ago
Who does this benefit besides spammers?
- RamblingCTO 2y ago
  People who want to make sure that nothing wrong is shared with spammers or the world in general?
  - Gerardo1 2y ago
    Why would you want that? I would, in general, prefer that incorrect information about me was shared with spammers, if any information is shared. Ditto for most third parties that I don't have a direct relationship with or ongoing conversation. And even then, usually the information they need about me is pretty limited.
    - RamblingCTO 2y ago
      nothing wrong = nothing I want out there. not talking about security through obfuscation
      - Gerardo1 2y ago
        Ah gotcha, thanks!
- jillyboel 2y ago
  Stalkers and abusers
  - ozim 2y ago
    Or people who want to double check if they are not vulnerable to stalking and abuse by a silly mistake.
- 69277494937 2y ago
  Knowing what malicious actors are capable of is important for protecting yourself against them.
ExxKA 2y ago
Just as recruiters were stopping to spam me via GitHub...
mistrial9 2y ago
[dead]
1317 2y ago
ok, but it doesn't actually tell you anything new except the email everything else is literally just the info on the github profile page
- diego_sandoval 2y ago
  And I assume the emails are obtained from the commits' metadata, which is known to show your email when you upload code to Github.
- daghamm 2y ago
  Email is visible in commit messages. So nothing new at all
belter 2y ago
Who would use their real name for GitHub? https://github.com/elonmusk https://github.com/elonmusk https://github.com/donaldtrump https://github.com/donaldtrump
Gerardo1 2y ago
I do feel you have a bit of an ethical obligation to also have a "how to avoid leaking this information" section in your README.
areyourllySorry 2y ago
also see gitrecon
Xaena 2y ago
You may not be the creator, but the intent of this repo appears to be at odds with GitHub's acceptable use policies. For anyone else dealing with recruiters or companies spamming you from your github commit email, it's reportable under information usage restrictions and privacy. https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies#7-information-usage-restrictions https://docs.github.com/en/site-policy/acceptable-use-polici...
- compootr 2y ago
  as a non-user, I'm not bound by their policies :3 also, don't they have an email masking option? i remember seeing some generated @github.com email in commit logs
  - astr0n0mer 2y ago
    That's right, you can enable that email by checking "Keep my email addresses private" at https://github.com/settings/emails#toggle_visibility_note https://github.com/settings/emails#toggle_visibility_note
danso 2y ago
Uh couldn't you use the Events API to more efficiently go through someone's recent commits? def findEmailFromContributor(username, repo, contributor): response = requests.get('https://github.com/%s/%s/commits?author=%s' % (username, repo, contributor), auth=HTTPBasicAuth(username, '')).text latestCommit = re.search(r'href="/%s/%s/commit/(.*?)"' % (username, repo), response) if latestCommit: latestCommit = latestCommit.group(1) else: latestCommit = 'dummy' commitDetails = requests.get('https://github.com/%s/%s/commit/%s.patch' % (username, repo, latestCommit), auth=HTTPBasicAuth(username, '')).text email = re.search(r'<(.*)>', commitDetails)
gokayburuc_dev 2y ago
Correct me if I'm wrong, but isn't this feature already in Github API Tools?Project dashboards and contributors' e-mail addresses can already be seen in the free Github API Tools.At this point, the only advantage may be to compile all the information together.When data is requested in Json format, Github shares most of the data for free.

116 points by CHEF-KOCH 2y ago

cpursley 2y ago

That's basically the idea behind https://reporeach.com https://reporeach.com

numinix 2y ago
How can you tell? This website doesn't explain what the product is, how it works, or even bother with a privacy policy.
- confiq 2y ago
  It also requires registration to use it.
dustyharddrive 2y ago
This looks very GDPR compliant!

zellyn 2y ago

[+] login : zellyn [+] id : 33625 [+] avatar_url : https://avatars.githubusercontent.com/u/33625?v=4 [+] name : Zellyn Hunter [+] company : Square [+] blog : http://www.zellyn.com/ [+] location : Atlanta [+] bio : Programmer at Square. Mostly (currently) Go. [+] public_repos : 52 [+] public_gists : 47 [+] followers : 101 [+] following : 20 [+] created_at : 2008-11-10T13:26:38Z [+] updated_at : 2025-03-03T00:51:46Z [+] public_gists : https://gist.github.com/zellyn [+] SSH_keys : https:/github.com/zellyn.keys [+] email : hippytrail@gmail.com zellyn@squareup.com tomcw@users.noreply.github.com zellyn@gmail.com Pretty much spot on, except for the emails. The ones with username `zellyn` are correct; the others are people who've contributed changes to repos I created (I think).

Dotnaught 2y ago

Seems like its more trouble than just appending .patch to a commit.

theyknowitsxmas 2y ago

Who does this benefit besides spammers?

RamblingCTO 2y ago
People who want to make sure that nothing wrong is shared with spammers or the world in general?
- Gerardo1 2y ago
  Why would you want that? I would, in general, prefer that incorrect information about me was shared with spammers, if any information is shared. Ditto for most third parties that I don't have a direct relationship with or ongoing conversation. And even then, usually the information they need about me is pretty limited.
  - RamblingCTO 2y ago
    nothing wrong = nothing I want out there. not talking about security through obfuscation
    - Gerardo1 2y ago
      Ah gotcha, thanks!
jillyboel 2y ago
Stalkers and abusers
- ozim 2y ago
  Or people who want to double check if they are not vulnerable to stalking and abuse by a silly mistake.
69277494937 2y ago
Knowing what malicious actors are capable of is important for protecting yourself against them.

ExxKA 2y ago

Just as recruiters were stopping to spam me via GitHub...

mistrial9 2y ago

[dead]

1317 2y ago

ok, but it doesn't actually tell you anything new except the email everything else is literally just the info on the github profile page

diego_sandoval 2y ago
And I assume the emails are obtained from the commits' metadata, which is known to show your email when you upload code to Github.
daghamm 2y ago
Email is visible in commit messages. So nothing new at all

belter 2y ago

Who would use their real name for GitHub? https://github.com/elonmusk https://github.com/elonmusk https://github.com/donaldtrump https://github.com/donaldtrump

Gerardo1 2y ago

I do feel you have a bit of an ethical obligation to also have a "how to avoid leaking this information" section in your README.

areyourllySorry 2y ago

also see gitrecon

Xaena 2y ago

You may not be the creator, but the intent of this repo appears to be at odds with GitHub's acceptable use policies. For anyone else dealing with recruiters or companies spamming you from your github commit email, it's reportable under information usage restrictions and privacy. https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies#7-information-usage-restrictions https://docs.github.com/en/site-policy/acceptable-use-polici...

compootr 2y ago
as a non-user, I'm not bound by their policies :3 also, don't they have an email masking option? i remember seeing some generated @github.com email in commit logs
- astr0n0mer 2y ago
  That's right, you can enable that email by checking "Keep my email addresses private" at https://github.com/settings/emails#toggle_visibility_note https://github.com/settings/emails#toggle_visibility_note

danso 2y ago

Uh couldn't you use the Events API to more efficiently go through someone's recent commits? def findEmailFromContributor(username, repo, contributor): response = requests.get('https://github.com/%s/%s/commits?author=%s' % (username, repo, contributor), auth=HTTPBasicAuth(username, '')).text latestCommit = re.search(r'href="/%s/%s/commit/(.*?)"' % (username, repo), response) if latestCommit: latestCommit = latestCommit.group(1) else: latestCommit = 'dummy' commitDetails = requests.get('https://github.com/%s/%s/commit/%s.patch' % (username, repo, latestCommit), auth=HTTPBasicAuth(username, '')).text email = re.search(r'<(.*)>', commitDetails)

gokayburuc_dev 2y ago

Correct me if I'm wrong, but isn't this feature already in Github API Tools?Project dashboards and contributors' e-mail addresses can already be seen in the free Github API Tools.At this point, the only advantage may be to compile all the information together.When data is requested in Json format, Github shares most of the data for free.