[{"data":1,"prerenderedAt":528},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-the-trashcash-turning-deleted-files-into-bounties":33,"post-nav-the-trashcash-turning-deleted-files-into-bounties":506,"video-the-trashcash-turning-deleted-files-into-bounties":518,"i-tabler:copy":526},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":491,"coverImage":495,"date":496,"description":497,"draft":14,"extension":498,"meta":499,"navigation":30,"noindex":14,"path":500,"readingTime":501,"seo":502,"slug":503,"stem":503,"updatedAt":504,"youtubeId":42,"__hash__":505},"blog\u002Fthe-trashcash-turning-deleted-files-into-bounties.md","The TrashCash | Turning Deleted Files Into Bounties",{"type":37,"value":38,"toc":474},"minimark",[39,43,47,50,58,63,66,69,84,88,91,113,116,120,127,132,181,184,188,216,219,223,254,262,266,292,295,299,333,336,340,377,380,384,409,412,416,419,422,425,429,449,452,456,459,464,467,470],[40,41],"post-media",{"video":42},"PX88QTgE1GY",[44,45,46],"p",{},"Most hunters are stuck chasing the usual suspects: XSS, SQLi, SSRF, IDOR. But here’s a reality check, the biggest payouts don’t always come from payloads.",[44,48,49],{},"Sometimes, they come from history.",[44,51,52,53,57],{},"This article is about a technique I call ",[54,55,56],"strong",{},"TrashCash",": digging into Git repositories to restore deleted files that still contain sensitive information. Secrets developers thought they wiped clean often stay buried in commits, and if you know how to bring them back, you can turn “trash” into critical findings.",[59,60,62],"h2",{"id":61},"the-idea-behind-trashcash","The Idea Behind TrashCash",[44,64,65],{},"Every developer slips up. Maybe they accidentally commit an API key, a private cert, or a config file with passwords. They notice, panic, and delete the file.",[44,67,68],{},"But in Git, nothing is ever truly gone. The file might vanish from the repo’s surface, but the commit history keeps a copy.",[44,70,71,72,75,76,79,80,83],{},"That’s the ",[54,73,74],{},"trash"," part.",[77,78],"br",{},"\nYour job is to dig it back out and turn it into ",[54,81,82],{},"cash",": by reporting valid, high-impact leaks.",[59,85,87],{"id":86},"whats-the-goal","What’s the Goal?",[44,89,90],{},"The goal here isn’t just to “find a secret.” It’s about showing:",[92,93,94,101,107],"ul",{},[95,96,97,100],"li",{},[54,98,99],{},"How to restore deleted files"," from Git history.",[95,102,103,106],{},[54,104,105],{},"How to triage them"," for sensitive data.",[95,108,109,112],{},[54,110,111],{},"Why this matters"," for bug bounty hunters.",[44,114,115],{},"Think of it like digital dumpster-diving. Only difference? This dumpster can contain AWS keys, auth tokens, internal certs, or CI\u002FCD configs.",[59,117,119],{"id":118},"hands-on-demo-step-by-step","Hands-On Demo: Step by Step",[44,121,122,123,126],{},"This is all done on a real ",[54,124,125],{},"YesWeHack-authorized program",". Nothing here goes outside scope.",[128,129,131],"h3",{"id":130},"_1-clone-the-repository","1. Clone the Repository",[133,134,139],"pre",{"code":135,"language":136,"meta":137,"className":138,"style":137},"git clone \u003Ctarget-repo-url> target-repo\ncd target-repo\n","bash","","shiki shiki-themes vitesse-dark vitesse-light",[140,141,142,172],"code",{},[143,144,147,151,155,159,162,166,169],"span",{"class":145,"line":146},"line",1,[143,148,150],{"class":149},"swzfi","git",[143,152,154],{"class":153},"sRRDT"," clone",[143,156,158],{"class":157},"sfIIG"," \u003C",[143,160,161],{"class":153},"target-repo-ur",[143,163,165],{"class":164},"sG2Fq","l",[143,167,168],{"class":157},">",[143,170,171],{"class":153}," target-repo\n",[143,173,175,179],{"class":145,"line":174},2,[143,176,178],{"class":177},"s6_DI","cd",[143,180,171],{"class":153},[44,182,183],{},"Bring the repo local. Always isolate your work.",[128,185,187],{"id":186},"_2-find-deleted-files","2. Find Deleted Files",[133,189,191],{"code":190,"language":136,"meta":137,"className":138,"style":137},"git log --diff-filter=D --summary | grep delete\n",[140,192,193],{},[143,194,195,197,200,204,207,210,213],{"class":145,"line":146},[143,196,150],{"class":149},[143,198,199],{"class":153}," log",[143,201,203],{"class":202},"se4ZP"," --diff-filter=D",[143,205,206],{"class":202}," --summary",[143,208,209],{"class":157}," |",[143,211,212],{"class":149}," grep",[143,214,215],{"class":153}," delete\n",[44,217,218],{},"This command lists every file that’s been deleted in the repo’s history. These are your candidates.",[128,220,222],{"id":221},"_3-inspect-the-history-of-a-file","3. Inspect the History of a File",[133,224,226],{"code":225,"language":136,"meta":137,"className":138,"style":137},"git log --oneline --all -- \u003Cpath>\n",[140,227,228],{},[143,229,230,232,234,237,240,243,245,248,251],{"class":145,"line":146},[143,231,150],{"class":149},[143,233,199],{"class":153},[143,235,236],{"class":202}," --oneline",[143,238,239],{"class":202}," --all",[143,241,242],{"class":202}," --",[143,244,158],{"class":157},[143,246,247],{"class":153},"pat",[143,249,250],{"class":164},"h",[143,252,253],{"class":157},">\n",[44,255,256,257,261],{},"This shows the commit hashes and messages related to that file. You’ll see ",[258,259,260],"em",{},"who deleted it, when, and why",".",[128,263,265],{"id":264},"_4-look-at-commit-context","4. Look at Commit Context",[133,267,269],{"code":268,"language":136,"meta":137,"className":138,"style":137},"git log --diff-filter=D --stat -- \u003Cpath>\n",[140,270,271],{},[143,272,273,275,277,279,282,284,286,288,290],{"class":145,"line":146},[143,274,150],{"class":149},[143,276,199],{"class":153},[143,278,203],{"class":202},[143,280,281],{"class":202}," --stat",[143,283,242],{"class":202},[143,285,158],{"class":157},[143,287,247],{"class":153},[143,289,250],{"class":164},[143,291,253],{"class":157},[44,293,294],{},"Now you’re checking the bigger picture: what else changed in that commit? Was it a rushed “fix typo” commit that also deleted a config? That’s suspicious.",[128,296,298],{"id":297},"_5-restore-the-file","5. Restore the File",[133,300,302],{"code":301,"language":136,"meta":137,"className":138,"style":137},"git checkout \u003Ccommit-hash>^ -- \u003Cpath>\n",[140,303,304],{},[143,305,306,308,311,313,316,318,320,323,325,327,329,331],{"class":145,"line":146},[143,307,150],{"class":149},[143,309,310],{"class":153}," checkout",[143,312,158],{"class":157},[143,314,315],{"class":153},"commit-has",[143,317,250],{"class":164},[143,319,168],{"class":157},[143,321,322],{"class":153},"^",[143,324,242],{"class":202},[143,326,158],{"class":157},[143,328,247],{"class":153},[143,330,250],{"class":164},[143,332,253],{"class":157},[44,334,335],{},"This brings back the deleted file locally. Remember, never push this upstream. You’re only restoring it for analysis.",[128,337,339],{"id":338},"_6-peek-inside","6. Peek Inside",[133,341,343],{"code":342,"language":136,"meta":137,"className":138,"style":137},"grep -nE \"AKIA|-----BEGIN PRIVATE KEY-----|password|secret|token\" \u003Cpath> || true\n",[140,344,345],{},[143,346,347,350,353,357,360,363,365,367,369,371,374],{"class":145,"line":146},[143,348,349],{"class":149},"grep",[143,351,352],{"class":202}," -nE",[143,354,356],{"class":355},"sy_C3"," \"",[143,358,359],{"class":153},"AKIA|-----BEGIN PRIVATE KEY-----|password|secret|token",[143,361,362],{"class":355},"\"",[143,364,158],{"class":157},[143,366,247],{"class":153},[143,368,250],{"class":164},[143,370,168],{"class":157},[143,372,373],{"class":157}," ||",[143,375,376],{"class":177}," true\n",[44,378,379],{},"This lets you preview the file for patterns like AWS keys, private keys, or hardcoded credentials.",[128,381,383],{"id":382},"_7-cross-check-for-context","7. Cross-Check for Context",[133,385,387],{"code":386,"language":136,"meta":137,"className":138,"style":137},"git grep -n \"partial_key_prefix_or_domain\" || true\n",[140,388,389],{},[143,390,391,393,395,398,400,403,405,407],{"class":145,"line":146},[143,392,150],{"class":149},[143,394,212],{"class":153},[143,396,397],{"class":202}," -n",[143,399,356],{"class":355},[143,401,402],{"class":153},"partial_key_prefix_or_domain",[143,404,362],{"class":355},[143,406,373],{"class":157},[143,408,376],{"class":177},[44,410,411],{},"Search the repo for references. Maybe that AWS key is tied into a CI script, or the cert connects to staging servers. This boosts the severity of your finding.",[59,413,415],{"id":414},"scale-and-automation","Scale and Automation",[44,417,418],{},"Doing this manually across hundreds of repos takes time. You could be digging through commits all week.",[44,420,421],{},"That’s why I scripted it. Just a simple Bash loop that runs in the background on a VPS and alerts me via Discord when it finds matches.",[44,423,424],{},"The point isn’t the script. It’s the idea. If you can script, automate it. If not, learn how. Either way, the technique stays the same.",[59,426,428],{"id":427},"quick-recap","Quick Recap",[92,430,431,437,440,443],{},[95,432,433,436],{},[54,434,435],{},"Deleted doesn’t mean gone",": Git keeps history.",[95,438,439],{},"You can restore deleted files and analyze them.",[95,441,442],{},"Secrets often hide in configs, certs, or keys devs thought they removed.",[95,444,445,446,261],{},"With proper triage, these findings can lead to ",[54,447,448],{},"high-severity bounties",[44,450,451],{},"That’s why TrashCash matters. What looks like garbage can be your biggest report.",[59,453,455],{"id":454},"final-words","Final Words",[44,457,458],{},"Hunting isn’t always about flashy payloads or new zero-days. Sometimes, it’s about thinking differently, looking where others don’t, and using the tools we already have in smarter ways.",[44,460,461,463],{},[54,462,56],{}," is one of those methods, simple, overlooked, and extremely powerful when applied right.",[44,465,466],{},"So next time you’re in a repo, don’t just look at the code that’s there. Look at the ghosts of the files that came before.",[44,468,469],{},"Because in Git… the trash never really leaves.",[471,472,473],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html pre.shiki code .sfIIG, html code.shiki .sfIIG{--shiki-default:#CB7676;--shiki-light:#AB5959}html pre.shiki code .sG2Fq, html code.shiki .sG2Fq{--shiki-default:#DBD7CAEE;--shiki-light:#393A34}html pre.shiki code .s6_DI, html code.shiki .s6_DI{--shiki-default:#B8A965;--shiki-light:#998418}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html pre.shiki code .sy_C3, html code.shiki .sy_C3{--shiki-default:#C98A7D77;--shiki-light:#B5695977}",{"title":137,"searchDepth":475,"depth":475,"links":476},3,[477,478,479,488,489,490],{"id":61,"depth":174,"text":62},{"id":86,"depth":174,"text":87},{"id":118,"depth":174,"text":119,"children":480},[481,482,483,484,485,486,487],{"id":130,"depth":475,"text":131},{"id":186,"depth":475,"text":187},{"id":221,"depth":475,"text":222},{"id":264,"depth":475,"text":265},{"id":297,"depth":475,"text":298},{"id":338,"depth":475,"text":339},{"id":382,"depth":475,"text":383},{"id":414,"depth":174,"text":415},{"id":427,"depth":174,"text":428},{"id":454,"depth":174,"text":455},[492,493,494],"Bug Bounty","Linux","Penetration Testing","\u002Fimages\u002Fblog\u002Fthe-trashcash-turning-deleted-files-into-bounties\u002Fthe-trashcash-turning-deleted-files-into-bountie.webp","2025-10-15","TrashCash: restoring deleted files from Git history to recover the secrets developers thought they wiped. The biggest payouts aren't always payloads.","md",{},"\u002Fthe-trashcash-turning-deleted-files-into-bounties",null,{"title":35,"description":497},"the-trashcash-turning-deleted-files-into-bounties","2025-10-28","ruRkiGVSLBiwz6IWPL9WRWq2_Fof50WwsajSuVJOmdY",{"older":507,"newer":512,"total":517},{"slug":508,"title":509,"date":510,"position":511},"how-i-found-idors-that-shouldnt-exist","How I Found IDORs That Shouldn’t Exist","2025-10-12",18,{"slug":513,"title":514,"date":515,"position":516},"3-tricks-to-hunt-faster-in-bug-bounty","3 Tricks to Hunt Faster in Bug Bounty","2025-10-19",16,68,{"id":42,"title":35,"published":519,"url":520,"description":521,"durationSeconds":522,"viewCount":523,"thumbnail":524,"thumbnailSrcset":525},"2025-10-15T19:00:26Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=PX88QTgE1GY","In this episode, we’re digging into Git’s forgotten history. Most hunters chase surface-level bugs - XSS, SQLi, SSRF. But the real gold often hides in the files developers thought they deleted.",1130,3405,"\u002Fimages\u002Fvideos\u002FPX88QTgE1GY-800.webp","\u002Fimages\u002Fvideos\u002FPX88QTgE1GY-800.webp 800w, \u002Fimages\u002Fvideos\u002FPX88QTgE1GY-1280.webp 1280w",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":527},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941257617]