This is a multiple threads tool to detect whether a site has the .git
folder
leakage vulnerability. It is able to download the target .git
folder almost
completely. This tool also works when the DirectoryListings
feature is
disabled. It is worth mentioning that this tool will download almost all files
of the target git repository and then rebuild them locally, which makes this
tool State of the art in this area. For example, tools like [githack] just
simply restore the latest version. With GitHacker's help, you can view the
developer's commit history, which makes a better understanding of the character
and psychology of developers, so as to lay the foundation for further code
audition.
2021-08-01 Fixed: Malicious .git folder maybe harmful to the user of this tool
2021-05-25
Tools | Index | Source Code | Reflogs | Stashes | Commits | Branches | Remotes | Tags |
---|---|---|---|---|---|---|---|---|
GitTools | βοΈ | βοΈ | βοΈ | β | βοΈ | β | βοΈ | β |
dvcs-ripper | βοΈ | βοΈ | βοΈ | β | βοΈ | β | βοΈ | β |
GitHack | βοΈ | βοΈ | β | β | β | β | β | β |
git-dumper | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ |
GitHacker | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ | βοΈ |
GitTools | β | βοΈ | βοΈ | β | βοΈ | β | βοΈ | β |
dvcs-ripper | β | β | β | β | β | β | β | β |
GitHack | β | βοΈ | β | β | β | β | β | β |
git-dumper | β | βοΈ | βοΈ | βοΈ | βοΈ | β | βοΈ | β |
GitHacker | β | βοΈ | βοΈ | βοΈ | βοΈ | πͺ | βοΈ | πͺ |
- git >= 2.11.0
- Python 3
pip3 install GitHacker
githacker --url http://127.0.0.1/.git/ --folder result
-
Download packed files firstly(Unsolvable via StackOverflow) - Download tags and branches when Index enabled
- Try common tags and branches when Index disabled
- find packed refs
- γ.git/ folder attackγComparison of attack tools (Part I)
- γ.git/ folder attackγComparison of attack tools (Part II)
THE DRINKWARE LICENSE
<[email protected]> wrote this file. As long as
you retain this :x:tice you can do whatever you want
with this stuff. If we meet some day, and you think
this stuff is worth it, you can buy me the following
drink(s) in return.
Red Bull
JDB
Coffee
Sprite
Cola
Harbin Beer
etc
Wang Yihang