https://github.com/lijiejie/GitHack

A `.git` folder disclosure exploit
https://github.com/lijiejie/GitHack

Last synced: about 1 month ago
JSON representation

A `.git` folder disclosure exploit

• Host: GitHub
• URL: https://github.com/lijiejie/GitHack
• Owner: lijiejie
• Created: 2015-04-29T03:52:57.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2023-02-01T07:14:07.000Z (almost 2 years ago)
• Last Synced: 2024-10-29T17:55:21.155Z (about 1 month ago)
• Language: Python
• Size: 15.6 KB
• Stars: 3,120
• Watchers: 87
• Forks: 787
• Open Issues: 14
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - lijiejie/GitHack - A `.git` folder disclosure exploit (Python)

README

        
# GitHack

### This is important

### All users please git pull to update source code. (2022-05-09)  

GitHack is a `.git` folder disclosure exploit. 

It rebuild source code from .git folder while keep directory structure unchanged.

GitHack是一个.git泄露利用脚本，通过泄露的.git文件夹下的文件，重建还原工程源代码。

渗透测试人员、攻击者，可以进一步审计代码，挖掘：文件上传，SQL注射等web安全漏洞。

## Change Log

* 2022-05-09: Bug fix, thanks  [@justinsteven](https://github.com/justinsteven) . 

* 2022-04-07：Fix arbitrary file write vulnerability.  Thanks for [@justinsteven](https://github.com/justinsteven)  \'s bug report, it's very helpful.

* 2022-04-07：Add python3.x support

## How It works ##

* 解析.git/index文件，找到工程中所有的： ( 文件名，文件sha1 )

* 去.git/objects/ 文件夹下下载对应的文件

* zlib解压文件，按原始的目录结构写入源代码

## Usage ##

    python GitHack.py http://www.openssl.org/.git/

## Thanks ##

Thanks for sbp's great work, I used his .git index parser [gin - a Git index file parser](https://github.com/sbp/gin).