{"id":15403894,"url":"https://github.com/twe4ked/gitsha","last_synced_at":"2026-04-25T16:33:31.363Z","repository":{"id":66271082,"uuid":"240606163","full_name":"twe4ked/gitsha","owner":"twe4ked","description":"Git SHA bruteforcing","archived":false,"fork":false,"pushed_at":"2020-02-14T22:03:29.000Z","size":7,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-28T01:52:05.302Z","etag":null,"topics":["bruteforce","git"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/twe4ked.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-02-14T22:03:14.000Z","updated_at":"2020-11-02T22:18:24.000Z","dependencies_parsed_at":"2023-06-14T02:15:36.666Z","dependency_job_id":null,"html_url":"https://github.com/twe4ked/gitsha","commit_stats":{"total_commits":1,"total_committers":1,"mean_commits":1.0,"dds":0.0,"last_synced_commit":"0000000bf4d2ea64a424cc9bacaed82374ab8929"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/twe4ked/gitsha","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twe4ked%2Fgitsha","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twe4ked%2Fgitsha/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twe4ked%2Fgitsha/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twe4ked%2Fgitsha/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/twe4ked","download_url":"https://codeload.github.com/twe4ked/gitsha/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twe4ked%2Fgitsha/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32269458,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-25T09:15:33.318Z","status":"ssl_error","status_checked_at":"2026-04-25T09:15:31.997Z","response_time":59,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bruteforce","git"],"created_at":"2024-10-01T16:10:35.738Z","updated_at":"2026-04-25T16:33:31.346Z","avatar_url":"https://github.com/twe4ked.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Git SHA bruteforcing\n\nPorted from [gitsha](https://github.com/charliesome/gitsha).\n\n```\n$ cargo run master 0000000\n# ... snip\nwrote commit: 00000006aa0926f0b717ce2300298ee1c6c07770\n$ git reset --hard 00000006aa0926f0b717ce2300298ee1c6c07770\nHEAD is now at 0000000 Initial commit\n```\n\n## Explanation\n\nThis project adds a new non-standard header to a git commit with some \"random\"\nnoise in it to brute force a desired commit sha.\n\nA git commit looks something like this:\n\n```\n$ git cat-file -p 7ad451611652dd82b007af02fff084d9dd92aa33\ntree ff8d0ef193a646721d42b0bbee33e2445bc27ad6\nauthor Odin Dutton \u003codindutton@gmail.com\u003e 1581645496 +1100\ncommitter Odin Dutton \u003codindutton@gmail.com\u003e 1581645496 +1100\n\nInitial commit\n```\n\nIf we look at the actual file on disk, it's also got a type and length at the\nbeginning:\n\n```\n$ alias inflate\ninflate='ruby -r zlib -e \"STDOUT.write Zlib::Inflate.inflate(STDIN.read)\"'\n$ cat .git/objects/00/00000c661b546588c94b409352e03e750209cb | inflate | hexdump -C\n00000000  63 6f 6d 6d 69 74 20 32  34 31 00 74 72 65 65 20  |commit 241.tree |\n00000010  66 66 38 64 30 65 66 31  39 33 61 36 34 36 37 32  |ff8d0ef193a64672|\n# ... snip\n```\n\nYou can see there is the word `commit` followed by a null byte, then the length\nof the commit object.\n\nWe then insert a new header and modify it in a loop until we match the provided\nSHA prefix. This leaves us with something like this:\n\n```\n$ git cat-file -p 0000000c661b546588c94b409352e03e750209cb\ntree ff8d0ef193a646721d42b0bbee33e2445bc27ad6\nauthor Odin Dutton \u003codindutton@gmail.com\u003e 1581645496 +1100\ncommitter Odin Dutton \u003codindutton@gmail.com\u003e 1581645496 +1100\nbruteforce 02a096f2000000000\n\nInitial commit\n```\n\nWe can then reset our branch to that commit to use our new brute forced commit.\n\n## This fork\n\nI ported this as a fun exercise to play with some more Rust.\n\n- Uses a separate header rather than modifying the commit message\n- Probably slower\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftwe4ked%2Fgitsha","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftwe4ked%2Fgitsha","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftwe4ked%2Fgitsha/lists"}