Git

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Ili ku-dump folda ya .git kutoka kwa URL tumia https://github.com/arthaud/git-dumper

Tumia https://www.gitkraken.com/ kuchunguza yaliyomo

Iwapo saraka .git itapatikana katika programu ya wavuti unaweza kupakua yaliyomo yote kwa kutumia wget -r http://web.com/.git. Kisha, unaweza kuona mabadiliko yaliyofanywa kwa kutumia git diff.

Zana hizi: Git-Money, DVCS-Pillage na GitTools zinaweza kutumika kupata yaliyomo ya saraka ya git.

Zana https://github.com/cve-search/git-vuln-finder inaweza kutumika kutafuta CVEs na ujumbe wa udhaifu wa usalama ndani ya commit messages.

Zana https://github.com/michenriksen/gitrob inatafuta data nyeti katika repositories za mashirika na wafanyakazi wake.

Repo security scanner ni zana ya mstari wa amri iliyotengenezwa kwa lengo moja: kukusaidia kugundua GitHub secrets ambazo developers walikutokea kwa bahati mbaya walipopush data nyeti. Na kama zingine, itakusaidia kupata passwords, private keys, usernames, tokens na zaidi.

Hapa unaweza kupata utafiti kuhusu github dorks: https://securitytrails.com/blog/github-dorks

Faster /.git dumping & dirlisting bypass (2024–2026)

  • holly-hacker/git-dumper ni rewrite ya 2024 ya classic GitTools dumper yenye parallel fetching (>10x speedup). Mfano: python3 git-dumper.py https://victim/.git/ out && cd out && git checkout -- .
  • Ebryx/GitDump brute-forces object names from .git/index, packed-refs, etc. ili kurejesha repos hata wakati directory traversal imezimwa: python3 git-dump.py https://victim/.git/ dump && cd dump && git checkout -- .

Tathmini ya haraka baada ya dump

cd dumpdir
# reconstruct working tree
git checkout -- .
# show branch/commit map
git log --graph --oneline --decorate --all
# list suspicious config/remotes/hooks
git config -l
ls .git/hooks

Kutafuta siri/credentials (zana za sasa)

  • TruffleHog v3+: entropy+regex na kupitia historia ya Git kiotomatiki. trufflehog git file://$PWD --only-verified --json > secrets.json
  • Gitleaks (v8+): seti ya sheria za regex ya haraka, inaweza kuchunguza mti uliotolewa au historia nzima. gitleaks detect -v --source . --report-format json --report-path gitleaks.json

Marejeo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks