<story><title>I analyzed Stack Overflow for secrets</title><url>https://matan-h.com/analyze-stackoverflow</url></story><parent_chain></parent_chain><comment><author>Thorrez</author><text>Reminds me of this hilarious bug bounty:&lt;p&gt;1. Person reports some vuln in HackerOne itself to HackerOne&lt;p&gt;2. A HackerOne employee tries to reproduce it, and unknowlingly copies and pastes his&amp;#x2F;her cookies into the HackerOne report&lt;p&gt;3. The reporter takes those cookies, and logs in as the HackerOne employee&lt;p&gt;4. The reporter files a new vuln report &amp;quot;You are disclose for me you session. you are gevi me your session on last report. I am can use your session(sorry)&amp;quot;&lt;p&gt;5. $20,000 bounty&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;hackerone.com&amp;#x2F;reports&amp;#x2F;745324&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;hackerone.com&amp;#x2F;reports&amp;#x2F;745324&lt;/a&gt;</text></comment>
<story><title>I analyzed Stack Overflow for secrets</title><url>https://matan-h.com/analyze-stackoverflow</url></story><parent_chain></parent_chain><comment><author>onetimeuse92304</author><text>&amp;gt; Turns out, most of it is useless: For using most data, you need more information than just the api key.&lt;p&gt;I think you mean low effort attacks.&lt;p&gt;A determined attacker would attempt to gather more information, for example research the author of the post. Many of the authors give enough clues so that you can identify a person, even if comments are written using different handles.&lt;p&gt;Also some of these secrets go in pairs with something else that is enough to get a successful auth. For example, AWS secret usually goes in pair with everything you need to connect.</text></comment>