https://github.com/nyancrimew/goop

Yet another tool to dump a git repository from a website, focused on as-complete-as-possible dumps and handling weird edge-cases.
https://github.com/nyancrimew/goop

bug-bounty git infosec offensive-security

Last synced: 22 days ago
JSON representation

Yet another tool to dump a git repository from a website, focused on as-complete-as-possible dumps and handling weird edge-cases.

• Host: GitHub
• URL: https://github.com/nyancrimew/goop
• Owner: nyancrimew
• License: mit
• Created: 2020-10-30T17:49:11.000Z (about 4 years ago)
• Default Branch: main
• Last Pushed: 2024-03-22T12:24:41.000Z (9 months ago)
• Last Synced: 2024-08-05T17:31:32.363Z (4 months ago)
• Topics: bug-bounty, git, infosec, offensive-security
• Language: Go
• Homepage:
• Size: 83 KB
• Stars: 558
• Watchers: 5
• Forks: 48
• Open Issues: 8
• Metadata Files:
  • Readme: README.md
  • Funding: .github/FUNDING.yml
  • License: LICENSE

Awesome Lists containing this project

• awesome-hacking-lists - nyancrimew/goop - Yet another tool to dump a git repository from a website, focused on as-complete-as-possible dumps and handling weird edge-cases. (Go)

README

        
# goop

Yet another tool to dump a git repository from a website. goop tries to focus on as-complete-as-possible dumps and handling as many edge-cases as possible, compared to other tools, which seem to focus on bare minimum dumps. Original codebase heavily inspired by [arthaud/git-dumper](https://github.com/arthaud/git-dumper).

## Usage

```bash

Usage:

  goop [flags] url [DIR]

Flags:

  -f, --force   overrides DIR if it already exists

  -h, --help    help for goop

  -k, --keep    keeps already downloaded files in DIR, useful if you keep being ratelimited by server

  -l, --list    allows you to supply the name of a file containing a list of domain names instead of just one domain

```

### Example

```bash

$ goop example.com

```

## Installation

```bash

go install github.com/deletescape/goop@latest

```

## How does it work?

The tool will first check if directory listing is available. If it is, then it will just recursively download the .git directory (what you would do with `wget`).

If directory listing is not available, it will use several methods to find as many files as possible. Step by step, goop will:

* Fetch all common files (`.gitignore`, `.git/HEAD`, `.git/index`, etc.);

* Find as many refs as possible (such as `refs/heads/master`, `refs/remotes/origin/HEAD`, etc.) by analyzing `.git/HEAD`, `.git/logs/HEAD`, `.git/config`, `.git/packed-refs` and so on;

* Find as many objects (sha1) as possible by analyzing `.git/packed-refs`, `.git/index`, `.git/refs/*` and `.git/logs/*`;

* Fetch all objects recursively, analyzing each commits to find their parents;

* Run `git checkout .` to recover the current working tree;

* Attempt to fetch missing files listed in the git index;

* Attempt to create objects for manually fetched files;

* Attempt to fetch files listed in .gitignore