Skip to content
master
Switch branches/tags
Code

GitHacker

Desciption

This is a multiple threads tool to detect whether a site has the .git folder leakage vulnerability. It is able to download the target .git folder almost completely. This tool also works when the DirectoryListings feature is disabled. It is worth mentioning that this tool will download almost all files of the target git repository and then rebuild them locally, which makes this tool State of the art in this area. For example, tools like [githack] just simply restore the latest version. With GitHacker's help, you can view the developer's commit history, which makes a better understanding of the character and psychology of developers, so as to lay the foundation for further code audition.

Security Issues

2021-08-01 Fixed: Malicious .git folder maybe harmful to the user of this tool

Comparison of other tools

2021-05-25

Tools Index Source Code Reflogs Stashes Commits Branches Remotes Tags
GitTools ✔️ ✔️ ✔️ ❌ ✔️ ❌ ✔️ ❌
dvcs-ripper ✔️ ✔️ ✔️ ❌ ✔️ ❌ ✔️ ❌
GitHack ✔️ ✔️ ❌ ❌ ❌ ❌ ❌ ❌
git-dumper ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
GitHacker ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
GitTools ❌ ✔️ ✔️ ❌ ✔️ ❌ ✔️ ❌
dvcs-ripper ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌
GitHack ❌ ✔️ ❌ ❌ ❌ ❌ ❌ ❌
git-dumper ❌ ✔️ ✔️ ✔️ ✔️ ❌ ✔️ ❌
GitHacker ❌ ✔️ ✔️ ✔️ ✔️ 💪 ✔️ 💪

Requirments

  • git >= 2.11.0
  • Python 3

Installation

pip3 install GitHacker

Usage

githacker --url http://127.0.0.1/.git/ --folder result

Example

Demo

TODO

  • Download packed files firstly (Unsolvable via StackOverflow)
  • Download tags and branches when Index enabled
  • Try common tags and branches when Index disabled
  • find packed refs

Videos

asciinema

asciicast

YouTube

References

Acknowledgement

Licsence

THE DRINKWARE LICENSE

<wangyihanger@gmail.com> wrote this file. As long as 
you retain this :x:tice you can do whatever you want 
with this stuff. If we meet some day, and you think 
this stuff is worth it, you can buy me the following
drink(s) in return.

Red Bull
JDB
Coffee
Sprite
Cola
Harbin Beer
etc

Wang Yihang

About

🕷️ A Git source leak exploit tool that restores the entire Git repository, including data from stash, for white-box auditing and analysis of developers' mind

Topics

Resources

Packages

No packages published