Collaborate Disseminate
If an attacker gains full write access to an arbitrary branch in a Git repository, which technical attacks could they perform to compromise the integrity or availability of the data in the master branch?
This is assuming tha… Continue reading What can an attacker do with access to a compromised Git branch?
In WHOIS, every domain name has at least an email address, physical address and phone number that can be publicly accessed (assuming privacy is off).
Could the ability to receive messages/mail at these contact points allow a… Continue reading Could access to the WHOIS contact methods for a domain name provide any form of access or leverage to the domain?
When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review.
Reviewing the diff is obviously vulnerable to human error, as malicious cha… Continue reading How could malicious code changes in a GitHub pull request be masked by an attacker?
Many online Git hosting services (such as GitHub and GitLab) allow you to ‘protect’ certain branches so that only project administrators can modify them.
The purpose of this is to allow non-admin contributors to work in othe… Continue reading How can I improve the security of my protected branches in GitHub/GitLab?
When setting up any kind of server application (such as a web server, IRC server, etc) you can usually bind the application to particular IP addresses or hostnames. This tells the application to ‘listen’ on those addresses.