Back to case studies
Intermediate1 h - 1 h 30
Digital footprint of a username
One of your company’s API keys leaked on GitHub from an unknown account. Link that username to a person, separating solid evidence from false positives.
Briefing
GitHub secret scanning alerts you: one of your company’s production API keys was pushed to a public repository by the account “n0rthwind_dev”. The key is already revoked. The CISO wants to know whether this is an employee or contractor (internal mistake) or a third party (a more serious leak). You are acting within an internal investigation overseen by the legal team.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Enumerate accounts using the username
- Rule out false positives
- Use commit metadata
- Link the username to an identity
- Respect proportionality
Tools used in real investigations
Sherlock / MaigretGitHub API (.patch)WhatsMyNameGoogle LensWayback Machine
100% Free
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.