Roi Nisimi

When I tried a simple search on GitHub for pull_request_target, it resulted with over 90k code findings, which strengthen my confidence in the fruitful pursuit of this research. Before attempting exploitation, I decided to create a list companies with a public registered bug bounty program, and GitHub organizations that have at least one repository with over 5k stars. I then scanned all of the repositories of the aforementioned organizations and start the hunt. The results were surprising and concerning, with dozens of vulnerable targets, including sensitive repositories of Microsoft and Google. Using this attack vector, I could push code, steal secrets and often even manage pull requests (comment, approve, merge) and push organization-level packages. This process was heavily relied on AI to speed up my analysis and vulnerability research. At a very early stage I had transitioned from manual discovery to fully developed AI-agent that can find and exploit this vulnerabilities on my behalf. During this conference talk, I will demonstrate my step-by-step operations, thoughts and mindset.