How to exploit GitHub’s Contributions Graph

Let’s talk about the Contributions Graph on GitHub. For those of you who don’t know, the contributions graph on GitHub shows your contributions history using squares ranging from white to dark green depending upon the number of contributions made each day. Let’s face it, we all want it — the perfectly filled graph. It’s the weirdest flex of all.

You can get the perfectly filled graph within 10 minutes.

It’s no secret that the Contributions Graph on GitHub is not very secure. It’s a collection of data from your contributions on GitHub, displayed in a Graph. So, basically, you can push a repository with preset commit history and gain all those commits as contributions on GitHub. And reverting it is simple as well! Just delete the repo from your account.

Steps to make it work

1. Create a new repository on GitHub.
2. Clone that repository to your local.
3. Add the script to generate commits and then, execute it on your repository.
4. Push the repo to your remote.

Let’s talk in detail about the script

The script’s pretty straightforward. All it does is — makes some change in the repository & commits those changes with a fake timestamp — over and over again, as many time as you’d like.

The timestamp can be changed by updating two environment variables that git uses to set the timestamp for the commits — GIT_COMMITER_DATE & GIT_AUTHOR_DATE — which store the timestamps in the standard ISO format. Also commit using that timestamp, just to be sure.

echo "$i on $M/$D/$Y" > commit.md
export GIT_COMMITTER_DATE="$Y-$M-$D 12:$i:00"
export GIT_AUTHOR_DATE="$Y-$M-$D 12:$i:00"
git add commit.md -f
git commit --date="$Y-$M-$D 12:0$i:00" -m "$i on $M $D $Y"

Now, to do it over and over, wrap it in a loop —

for Y in {1980..2040}
do
  for M in {01..12}
  do
    for D in {01..31}
    do
      for i in {01..12}
      do
        echo "$i on $M/$D/$Y" > commit.md
        export GIT_COMMITTER_DATE="$Y-$M-$D 12:$i:00"
        export GIT_AUTHOR_DATE="$Y-$M-$D 12:$i:00"
        git add commit.md -f
        git commit --date="$Y-$M-$D 12:0$i:00" -m "$i on $M $D $Y"
      done
    done
  done
done

git push origin master
echo "" > commit.md
git commit -am "Cleanup"
git push origin master

— or 4 loops. As you might have noticed, you can generate commits both — way into the past and the future. Though 1970, I suppose, is as far back as you can go.

Next, you can make the script executable and run it using the following commands from your terminal —

chmod a+x script.sh
./script.sh

Conclusion

All the snippets assume that the script is within the repository you created. If you don’t want to push the script to remote, you can update the script to traverse to the directory of your choice. You can use the cd command for that.

Although, I will warn you, the script can take quite a bit of time depending upon how many commits you aim for.

I did face multiple issues while running the script. For some reason, all the contributions, that were generated, were not being shown on the GitHub — either only the ones for the last year in the timeframe, or only for partial year.

While I couldn’t find the cause or the fix for this — after playing around a bit, it seemed that the issue occurred only when I generated and pushed over a 1000 commits together. If you find the cause or the fix for this, do share in the comments.

Here’s the amazing article that introduced me to this exploit. But I don’t understand why he needs to create a new directory for each commit. Anyhow, do give it a read as well, if this doesn’t satiate you.

Finally, check out Gitfiti. Using this you can draw some crazy pixel art on your contributions graph.