Static Code Analysis
Rebuild a git repository from an exposed .git folder
Git ripper that reconstructs repos even when directory browsing is off.
overview
What dvcsripper-git does
When a target leaves .git reachable, point -u at that URL and reconstruct the repository objects into a FOLDER for source review.
Use it after you confirm an exposed .git path and need history even with listing disabled. Set -b for the branch, -t for parallel tasks, and -g to guess packed-refs.
Unlike secret scanners such as dora or dumpsterdiver, this node recovers the repo first. Hand the reconstructed tree to those tools next.
source github.com/kost/dvcs-ripper
use cases
Where dvcsripper-git fits
Recover source from an exposed .git
Reconstruct a repository from a leaked .git folder so you can review the source and history of an application that should not have shipped it.
Rip when directory listing is off
Walk the git object graph directly to pull the repo even when the server blocks browsing of the .git directory.
Feed recovered code into secret scanning
Hand the reconstructed repository to a credential scanner so hardcoded keys in the leaked history surface for remediation.
reference
dvcsripper-git inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | URL with the exposed .git folder. |
| use-branch | STRING | -b | Branch to rip (default: master). |
| use-proxy | STRING | -p | Proxy host to use for connections. |
| use-agent | STRING | -a | User agent string to send. |
| number-of-parallel-tasks | STRING | -t | Number of parallel tasks to run. |
| guess-packed-refs-name | BOOLEAN | -g | Intelligently guess the name of packed refs. |
| dont-verify-ssl | BOOLEAN | -s | Do not verify the SSL certificate. |
| verbose | BOOLEAN | -v | Verbose mode. |
Showing key inputs. dvcsripper-git exposes 16 inputs in total.
Full flag reference (16 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Url with .git folder. |
| verbose | BOOLEAN | -v | Verbose mode |
| use-agent | STRING | -a | Use agent <s> (default: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2) |
| use-proxy | STRING | -p | Use proxy <h> for connections |
| use-redis | STRING | -e | Use redis <s> server as server:port |
| use-branch | STRING | -b | Use branch <s> (default: master) |
| git-checkout-f | BOOLEAN | -c | perform 'git checkout -f' on end (default) |
| dont-verify-ssl | BOOLEAN | -s | Do not verify SSL cert |
| set-basic-auth-key | STRING | -ba | Set basic auth key |
| dont-override-files | BOOLEAN | -n | Do not overwrite files |
| guess-packed-refs-name | BOOLEAN | -g | Try to inteligently guess name of packed refs |
| use-session-name-redis | STRING | -k | Use session name <s> for redis (default: random) |
| brute-force-packed-refs | BOOLEAN | -x | Brute force packed refs (extremely slow!!) |
| max-number-of-redirects | STRING | -r | Specify max number of redirects (default: 0) |
| number-of-parallel-tasks | STRING | -t | Use <i> parallel tasks |
| mkdir-url-name-for-output | BOOLEAN | -m | Mkdir URL name when outputting (works good with -o) |
example
Run dvcsripper-git
# rip an exposed .git folder with parallel tasks and packed-refs guess# dvcsripper-git (rip-git.pl)dvcsripper-git -u https://example.com/.git/ -b master -t 8 -g -v -cdvcsripper-git: fetching https://example.com/.git/[+] HEAD -> refs/heads/master[+] packed-refs guessed via -g[*] object 9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2[*] object a1b2c3d4e5f60718293a4b5c6d7e8f9012345678[*] parallel tasks: 8[+] checkout -f completeSummary: 318 objects recovered for example.comOutput: ./example.comguidance
Choosing dvcsripper-git
Use dvcsripper-git when a target exposes its .git folder and you want the full source and history back, even with directory listing disabled. After it reconstructs the repo, scan with dora or dumpsterdiver for leaked credentials.
dora
Scans the recovered repository for exposed API keys. Natural next step after the rip completes.
dumpsterdiver
Hunts secrets across reconstructed files by entropy and rules. Pair it after ripping.
faq
dvcsripper-git questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run dvcsripper-git yourself
A URL with an exposed .git folder feeds dvcs-ripper, which reconstructs the repository and passes it to dora so leaked keys land as a queryable output.
Facts on this page come from the live Trickest tool library.