Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/digininja/GitHunter
A tool for searching a Git repository for interesting content
https://github.com/digininja/GitHunter
Last synced: about 2 months ago
JSON representation
A tool for searching a Git repository for interesting content
- Host: GitHub
- URL: https://github.com/digininja/GitHunter
- Owner: digininja
- License: gpl-3.0
- Created: 2019-07-30T13:58:46.000Z (about 5 years ago)
- Default Branch: master
- Last Pushed: 2023-12-18T23:21:43.000Z (9 months ago)
- Last Synced: 2024-06-15T01:46:44.162Z (3 months ago)
- Language: Go
- Size: 58.6 KB
- Stars: 91
- Watchers: 7
- Forks: 17
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-bugbounty-tools - GitHunter - A tool for searching a Git repository for interesting content (Miscellaneous / Git)
- awesome-hacking-lists - digininja/GitHunter - A tool for searching a Git repository for interesting content (Go)
README
# GitHunter
Every now and then, on an internal test, you'll land on a box with a Git repository already checked out into directory. GitHunter will help you search that repository for anything juicy which could help you with other areas of your test.
GitHunter looks for:
* Keywords in commit messages
* Keywords in files
* Interesting file names
Thanks to [@michenriksen](https://github.com/michenriksen/) for allowing me to include his existing [Gitrob](https://github.com/michenriksen/gitrob) signatures for doing the file name checks.
For the two keyword checks, the script uses a customisable JSON file to allow you to do either simple or regular expressesion searches, meaning you can target the discovery to your client's environment.
## Installation
These instructions aren't best practice, ideally you would install this with `go install...` but as far as I can tell this will only install the binary. I also need to install the `patterns.json` file somewhere so it can be used by the app and edited by users, so this is the best I can come up with for now. Any suggestions, let me know.
1. [Set up your Go environment.](https://golang.org/doc/install)
2. Change into the Go source directory:
```
cd ~go/src/github.com
```
1. Make a directory for me and go into it:
```
mkdir digininja ; cd digininja
```
1. Clone the project:
```
git clone https://github.com/digininja/GitHunter.git
```
1. Change into the project directory:
```
cd GitHunter/
```
1. Build it:
```
go build
```
You should now have a binary in the current directory.
## Usage
Usage is fairly simple, by default, GitHunter will look in the current directory for a `.git` directory and, if it finds one, will parse through it and show anything interesting it finds in either filenames or in commit comments. You can specify a different directory for the repository with the `-gitdir` parameter.
If you want to expand what is searched to include file contents at each commit, you can add the `-grep` parameter, but be warned, git, on my box at least, runs single threaded, and can take a long time to do the grepping on a large repository. It actually failed trying to grep through Metasploit, due to the sheer number of commits and content. Still worth trying it though, especially on smaller repos, as you may find something.
If you want a dump of the commit logs, without any commentary, then you can use the `-dump` parameter.
To specify a custom patterns file, use `-patterns` and to have the output without any fancy colours (easier for parsing) use `-nocolours`.
## Testing things out
If you want a repository to test things on, have a look at my [Leaky Repo](https://github.com/digininja/leakyrepo) which contains quite a few interesting things to find.