loading
Loading content
loading
Static Code Analysis
Git ripper that reconstructs repos even when directory browsing is off.
overview
When a target leaves .git reachable, point -u at that URL and reconstruct the repository objects into a FOLDER for source review.
Use it after you confirm an exposed .git path and need history even with listing disabled. Set -b for the branch, -t for parallel tasks, and -g to guess packed-refs.
Unlike secret scanners such as dora or dumpsterdiver, this node recovers the repo first. Hand the reconstructed tree to those tools next.
source github.com/kost/dvcs-ripper
use cases
Reconstruct a repository from a leaked .git folder so you can review the source and history of an application that should not have shipped it.
Walk the git object graph directly to pull the repo even when the server blocks browsing of the .git directory.
Hand the reconstructed repository to a credential scanner so hardcoded keys in the leaked history surface for remediation.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | URL with the exposed .git folder. |
| use-branch | STRING | -b | Branch to rip (default: master). |
| use-proxy | STRING | -p | Proxy host to use for connections. |
| use-agent | STRING | -a | User agent string to send. |
| number-of-parallel-tasks | STRING | -t | Number of parallel tasks to run. |
| guess-packed-refs-name | BOOLEAN | -g | Intelligently guess the name of packed refs. |
| dont-verify-ssl | BOOLEAN | -s | Do not verify the SSL certificate. |
| verbose | BOOLEAN | -v | Verbose mode. |
Showing key inputs. dvcsripper-git exposes 16 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Url with .git folder. |
| verbose | BOOLEAN | -v | Verbose mode |
| use-agent | STRING | -a | Use agent <s> (default: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2) |
| use-proxy | STRING | -p | Use proxy <h> for connections |
| use-redis | STRING | -e | Use redis <s> server as server:port |
| use-branch | STRING | -b | Use branch <s> (default: master) |
| git-checkout-f | BOOLEAN | -c | perform 'git checkout -f' on end (default) |
| dont-verify-ssl | BOOLEAN | -s | Do not verify SSL cert |
| set-basic-auth-key | STRING | -ba | Set basic auth key |
| dont-override-files | BOOLEAN | -n | Do not overwrite files |
| guess-packed-refs-name | BOOLEAN | -g | Try to inteligently guess name of packed refs |
| use-session-name-redis | STRING | -k | Use session name <s> for redis (default: random) |
| brute-force-packed-refs | BOOLEAN | -x | Brute force packed refs (extremely slow!!) |
| max-number-of-redirects | STRING | -r | Specify max number of redirects (default: 0) |
| number-of-parallel-tasks | STRING | -t | Use <i> parallel tasks |
| mkdir-url-name-for-output | BOOLEAN | -m | Mkdir URL name when outputting (works good with -o) |
example
# rip an exposed .git folder with parallel tasks and packed-refs guess# dvcsripper-git (rip-git.pl)dvcsripper-git -u https://example.com/.git/ -b master -t 8 -g -v -cdvcsripper-git: fetching https://example.com/.git/[+] HEAD -> refs/heads/master[+] packed-refs guessed via -g[*] object 9f3a1c2b7d4e5f60a1b2c3d4e5f6a7b8c9d0e1f2[*] object a1b2c3d4e5f60718293a4b5c6d7e8f9012345678[*] parallel tasks: 8[+] checkout -f completeSummary: 318 objects recovered for example.comOutput: ./example.comguidance
Use dvcsripper-git when a target exposes its .git folder and you want the full source and history back, even with directory listing disabled. After it reconstructs the repo, scan with dora or dumpsterdiver for leaked credentials.
Scans the recovered repository for exposed API keys. Natural next step after the rip completes.
Hunts secrets across reconstructed files by entropy and rules. Pair it after ripping.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
A URL with an exposed .git folder feeds dvcs-ripper, which reconstructs the repository and passes it to dora so leaked keys land as a queryable output.
Facts on this page come from the live Trickest tool library.