This is a multiple threads tool to download the `.git` folder and rebuild git repository locally.
Project description
GitHacker
Desciption
This is a multiple threads tool to detect whether a site has the .git
folder
leakage vulnerability. It is able to download the target .git
folder almost
completely. This tool also works when the DirectoryListings
feature is
disabled. It is worth mentioning that this tool will download almost all files
of the target git repository and then rebuild them locally, which makes this
tool State of the art in this area. For example, tools like [githack] just
simply restore the latest version. With GitHacker's help, you can view the
developer's commit history, which makes a better understanding of the character
and psychology of developers, so as to lay the foundation for further code
audition.
PROCLAMATION (IMPORTANT)
Several VULNERABILITIES have been reported recently, if you are using GitHacker <= 1.1.0, please update your tool as soon as possible.
The remote .git
folder maybe malicious, so to prevent you from being attacked.
I highly recommend you run this tool under a disposable jailed environment
(eg: docker container).
Security Issues
2021-08-01 Fixed: Malicious .git folder maybe harmful to the user of this tool (Reported by Driver Tom)
2022-03-01 Fixed: Arbitrary file write via recursive file downloader (Reported by Justin Steven)
- To be released
2022-03-01 Fixed: Remote Code Execution via malicious .git/config
and .git/hooks/*
files (Reported by Justin Steven)
- To be released
Comparison of other tools
2021-05-25
Tools | Index | Source Code | Reflogs | Stashes | Commits | Branches | Remotes | Tags |
---|---|---|---|---|---|---|---|---|
GitTools | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :x: | :heavy_check_mark: | :x: | :heavy_check_mark: | :x: |
dvcs-ripper | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :x: | :heavy_check_mark: | :x: | :heavy_check_mark: | :x: |
GitHack | :heavy_check_mark: | :heavy_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
git-dumper | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
GitHacker | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
GitTools | :x: | :heavy_check_mark: | :heavy_check_mark: | :x: | :heavy_check_mark: | :x: | :heavy_check_mark: | :x: |
dvcs-ripper | :x: | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
GitHack | :x: | :heavy_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
git-dumper | :x: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :x: | :heavy_check_mark: | :x: |
GitHacker | :x: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :muscle: | :heavy_check_mark: | :muscle: |
Requirments
- git >= 2.11.0
- Python 3
Installation
pip3 install GitHacker
Usage
# quick start
githacker --url http://127.0.0.1/.git/ --output-folder result
# brute for the name of branchs / tags
githacker --brute --url http://127.0.0.1/.git/ --output-folder result
Example
TODO
- Publish Docker image to hub.docker.com
- Add Dockerfile
- Fix infinit downloading 404 files
-
Download packed files firstly(Unsolvable via StackOverflow) - Fix stash files missing due to the fix of #21, #23, #24 (
git clone
can't download stash files) - Use python f'string in
test.py
- Download tags and branches when Index enabled
- Try common tags and branches when Index disabled
- find packed refs
Videos
asciinema
YouTube
- 【.git/ folder attack】Comparison of attack tools (Part I)
- 【.git/ folder attack】Comparison of attack tools (Part II)
References
Acknowledgement
Licsence
THE DRINKWARE LICENSE
<wangyihanger@gmail.com> wrote this file. As long as
you retain this :x:tice you can do whatever you want
with this stuff. If we meet some day, and you think
this stuff is worth it, you can buy me the following
drink(s) in return.
Red Bull
JDB
Coffee
Sprite
Cola
Harbin Beer
etc
Wang Yihang
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for GitHacker-1.1.3-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 163558c1fc5e1da424905643ee97568b565310500cf2b876f3e0e6911c09d5e1 |
|
MD5 | cd1bd17d320edc770bdc516f739712b4 |
|
BLAKE2b-256 | f768c5585d7513f5e1ffb7e355c920ff668440cf0a52667364d95d89eb534256 |