Unlike the linked it didn't alter the commit date, but altered the Git code itself to add a new custom header to the commit object.
Git handles custom headers just fine since it ignores unknown headers for future compatibility. This commit still lives in the main Git repo at work without any issues:
commit 313375d995e6f8b7773c6ed1ee165e5a9e15690b
tree c9bebc99c05dfe61cccf02ebdf442945c8ff8b3c
parent 0dce2d45a79d26a593f0e12301cdfeb7eb23c17a
author Ævar Arnfjörð Bjarmason <avar@booking.com> 1319042708 +0200
committer Ævar Arnfjörð Bjarmason <avar@booking.com> 1319042708 +0200
lulz 697889 > git commit -F message
Try 0/4000000 to get a 1337 commit = 3650e08c9e1ecbbeec83daf7a959e3edcf15bd4f
Try 100000/4000000 to get a 1337 commit = 3952f7d5035f5e88f66aa5c70e5cc11fdd734852
Try 200000/4000000 to get a 1337 commit = 51c910f5d535c515a04796eb7c7a70cbd2325599
Try 300000/4000000 to get a 1337 commit = d70c3e64b1d963461a6ee2f518c613483b979d68
...
commit id = 313378458f8c4fb53c808f4b0bae5bf71ba5e23b
[master 3133784] 1337 Test Commit
1 file changed, 60 insertions(+), 35 deletions(-)
https://github.com/spence/git/commit/313378458f8c4fb53c808f4... $ git show --pretty=raw 313378458f8c4fb53c808f4b0bae5bf71ba5e23b | head -n 10
commit 313378458f8c4fb53c808f4b0bae5bf71ba5e23b
tree 7e93df01bfc9c187d58a0b96e756dd8ac0031c82
parent e4eef26d985177e4bdd32bf58b6ae40e7ae67289
author Spencer Creasey <screasey@monetate.com> 1396872901 -0400
committer Spencer Creasey <screasey@monetate.com> 1396872901 -0400
lulz 843475
1337 Test Commit
http://lists-archives.com/git/756394-choosing-the-sha1-prefix-of-your-commits.html
There's replies in that thread where the naïve technique I was using
was improved a lot.https://github.com/stuartpb/lhc
Mine allows using a custom word list in the commit message for the nonce.
Judging by this commit, I'm guessing gitbrute uses miniscule variations in the commit time instead.
EDIT: yep: https://github.com/bradfitz/gitbrute/blob/master/gitbrute.go
This means it is likely that, purely by coincidence, someone has at some point had their commit labeled as (badc0de).
I think the odds of an accidental collision with badc0de are pretty low.
1 - (1 - 1/16^7)^250000000 ~= 61%A Git commit is one kind of "object" in git. Objects in Git are hashed like so:
SHA1("[objecttype] [objectlen]\0[objectdata]")
and a commit object looks like this (blatantly stolen from the Stripe V3 CTF):
tree #{tree}
parent #{parent}
author CTF user <me@example.com> #{timestamp} +0000
committer CTF user <me@example.com> #{timestamp} +0000
Give me a Gitcoin
The "tree" in the commit is the hash tree reference that actually points to your code.It's still a very cool demonstration of why you really need to compare every single bit of your hashes.
Talk about how it was done, and a pointer to the code that was used: https://plus.google.com/115863474911002159675/posts/RT2Tvb1w...
they're hashes of the /commit/, which is the code + metadata including time + previous commit(s).
This was the premise of Stripe CTF V3's second challenge ("Level 1: Mine me a Gitcoin") this year.