liamg/gitjacker

🔪 :octocat: Leak git repositories from misconfigured websites

gitjacker

Gitjacker downloads git repositories and extracts their contents from sites where the .git directory has been mistakenly uploaded. It will still manage to recover a significant portion of a repository even where directory listings are disabled.

For educational/penetration testing use only.

More information at https://liam-galvin.co.uk/security/2020/09/26/leaking-git-repos-from-misconfigured-sites.html

Installation

curl -s "https://raw.githubusercontent.com/liamg/gitjacker/master/scripts/install.sh" | bash

...or grab a precompiled binary.

You will need to have git installed to use Gitjacker.

In The News

• 20/06/21: Console 58 - Awesome newsletter featuring tools and beta releases for developers.
• 19/10/20: ZDNet Article - New Gitjacker tool lets you find .git folders exposed online

gitjacker's Issues

Running without arguments should default to --help

Running gitjacker without any arguments will print Error: accepts 1 arg(s), received 0. To be more user-friendly, it should default to showing the help message.

./install.sh: line 8: jq: command not found

I tried installing but it shows an error

./install.sh: line 8: jq: command not found

Methodology

Can I use multiple targets list.txt to check the vulnerability

Support Proxy

Would be better to add a feature to support socks/proxy

.git/config

hi on bruteforcing a rdp program https://dr-core-prod-microsites-1.ec2.digitalresources.jisc.ac.uk/.git/config i found this , when i use gitjacker to extract data

The provided URL does not appear vulnerable.

Error: no .git directory is available at this URL: failed to retrieve https://dr-core-prod-microsites-1.ec2.digitalresources.jisc.ac.uk/.git/HEAD: Get "https://dr-core-prod-microsites-1.ec2.digitalresources.jisc.ac.uk/.git/HEAD": x509: certificate is valid for *.core.ac.uk, core.ac.uk, not dr-core-prod-microsites-1.ec2.digitalresources.jisc.ac.uk

regards
Sabeesh

How to install and run this tool on windows 10 machine.

I have cloned the repository but not understanding what are the requirements of the tool and how to install and run it. Please help me out at the earliest.
Thank you.

Please bump golang.org/x/sys dependency

This package transitively depends on a version of golang.org/x/sys too outdated to support more recent platforms like riscv64-freebsd. Please bump the dependency to permit a build there.

Support Self-Signed Certs

Tried to use this for an internal, but it seems to fail when there is a self-signed cert.

I will see what I can do in the source and make a PR if it makes sense.

Thanks

Can we get an ARM version of this?

It would be awesome to have an ARM version of gitjacker built right into the precompiled binaries section of the releases. As more and more computers make the move to ARM, I believe it would be beneficial to have an ARM release. I want to contribute, but am not sure how to compile it for ARM.

Importing list of urls

Hi Bro, thanks for this amazing tool. Just a quick question/suggestion, this tool currently accept only 1 URL at a time. Can you add functionality where it takes list of subdomains from a file?