Scrabble 使用手册（快速Git泄露扫描器）¶

1. 尝试访问常见的 .git 路径
   - /.git/
   - /.git/config
   - /.git/HEAD
   - /.git/index

2. 检测路径变体
   - /test/.git/
   - /backup/.git/
   - /old/.git/

3. 并发请求
   - 使用 Go 协程
   - 高效并发处理

4. 报告结果
   - 返回可访问的路径
   - 显示 HTTP 状态码

# 需要 Go 1.16+
go install github.com/BishopFox/scrabble@latest

# 验证安装
scrabble --version

# 查看帮助
scrabble --help

# 访问 Releases 页面下载
# https://github.com/BishopFox/scrabble/releases

# Linux
wget https://github.com/BishopFox/scrabble/releases/download/v1.0/scrabble-linux-amd64
chmod +x scrabble-linux-amd64
sudo mv scrabble-linux-amd64 /usr/local/bin/scrabble

# macOS
wget https://github.com/BishopFox/scrabble/releases/download/v1.0/scrabble-darwin-amd64
chmod +x scrabble-darwin-amd64
sudo mv scrabble-darwin-amd64 /usr/local/bin/scrabble

# Windows
# 下载 scrabble-windows-amd64.exe

# 克隆仓库
git clone https://github.com/BishopFox/scrabble.git
cd scrabble

# 编译
go build -o scrabble

# 安装
sudo mv scrabble /usr/local/bin/

# 验证
scrabble --version

Go 1.16+ (仅编译时需要)
网络连接

# 扫描单个目标
scrabble http://example.com

# 扫描指定 .git 路径
scrabble http://example.com/.git/

# 扫描 HTTPS
scrabble https://secure.example.com

位置参数:
  URL                   目标 URL

可选参数:
  -c, --concurrency N   并发数（默认:10）
  -t, --timeout N       超时时间（秒，默认:10）
  -o, --output FILE     输出文件
  -v, --verbose         详细输出
  -q, --quiet           静默模式
  -h, --help            显示帮助
  -V, --version         显示版本

# 基本扫描
scrabble http://target.com

# 增加并发
scrabble http://target.com --concurrency 20

# 设置超时
scrabble http://target.com --timeout 5

# 详细输出
scrabble http://target.com --verbose

# 保存结果
scrabble http://target.com --output results.txt

# 默认并发（10）
scrabble http://target.com

# 低并发（更隐蔽）
scrabble http://target.com -c 5

# 高并发（更快）
scrabble http://target.com -c 50

# 极限并发（大量目标时）
scrabble http://target.com -c 100

# 默认超时（10秒）
scrabble http://target.com

# 短超时（快速扫描）
scrabble http://target.com -t 3

# 长超时（慢速网络）
scrabble http://target.com -t 30

# 详细输出（显示所有请求）
scrabble http://target.com --verbose

# 静默模式（只显示发现的泄露）
scrabble http://target.com --quiet

# 保存到文件
scrabble http://target.com -o findings.txt

# 方法1: Shell 循环
for domain in $(cat domains.txt); do
    echo "[*] Scanning: $domain"
    scrabble "http://$domain" -q
done

# 方法2: xargs 并行
cat domains.txt | xargs -I {} -P 10 scrabble "http://{}" -q

# 方法3: GNU Parallel
parallel -j 10 scrabble "http://{}" -q :::: domains.txt

# CTF 题目给出 URL
scrabble http://challenge.com

# 如果发现泄露，使用其他工具下载
# scrabble 只负责检测，不负责下载
githacker -u http://challenge.com/.git/ -o source

# 准备子域名列表
cat > subdomains.txt << 'EOF'
www.example.com
admin.example.com
dev.example.com
test.example.com
api.example.com
EOF

# 批量扫描
cat subdomains.txt | while read domain; do
    echo "[*] $domain"
    scrabble "http://$domain" -q -o results.txt
done

# 查看发现的泄露
cat results.txt

# 扫描
scrabble http://example.com -v

# 会自动检测:
# http://example.com/.git/
# http://example.com/.git/config
# http://example.com/.git/HEAD
# http://example.com/.git/index
# http://example.com/backup/.git/
# http://example.com/test/.git/
# ...

#!/bin/bash
# 完整工作流脚本

TARGET="$1"

echo "[1/2] 检测 .git 泄露..."
if scrabble "$TARGET" -q | grep -q "Found"; then
    echo "[+] 发现泄露！"

    echo "[2/2] 下载源码..."
    githacker -u "$TARGET/.git/" -o source

    echo "[+] 分析..."
    cd source
    grep -r "flag{" .
else
    echo "[-] 未发现泄露"
fi

# GitHub Actions 示例
name: Git Leak Scanner

on: [push]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Install Scrabble
        run: go install github.com/BishopFox/scrabble@latest

      - name: Scan Target
        run: scrabble https://example.com --output results.txt

      - name: Check Results
        run: |
          if grep -q "Found" results.txt; then
            echo "::error::Git leak detected!"
            exit 1
          fi

# CTF 比赛中快速检测
$ scrabble http://challenge.com

[+] Checking http://challenge.com/.git/config
[+] Found: http://challenge.com/.git/config (200 OK)
[+] Found: http://challenge.com/.git/HEAD (200 OK)

# 确认泄露后立即下载
$ githacker -u http://challenge.com/.git/ -o source
$ cd source && grep -r "flag{" .

# 扫描多个子域名
cat > targets.txt << 'EOF'
www.target.com
admin.target.com
dev.target.com
test.target.com
backup.target.com
old.target.com
staging.target.com
EOF

# 并行扫描（10个并发）
cat targets.txt | parallel -j 10 scrabble "http://{}" -q -o findings.txt

# 提取成功的
grep "Found" findings.txt

# 输出示例:
# [+] Found: http://dev.target.com/.git/config (200 OK)
# [+] Found: http://backup.target.com/.git/HEAD (200 OK)

# 扫描大量目标（1000+）
# 使用高并发

cat large_targets.txt | xargs -P 50 -I {} sh -c '
    echo "[*] Scanning: {}"
    scrabble "http://{}" -q -t 5 >> mass_scan_results.txt 2>&1
'

# 统计结果
echo "Total found: $(grep -c "Found" mass_scan_results.txt)"

# 提取 URL
grep "Found" mass_scan_results.txt | awk '{print $3}' > vulnerable.txt

# 测试不同路径
paths=(
    ""
    "/admin"
    "/test"
    "/backup"
    "/old"
    "/dev"
    "/staging"
    "/_old"
    "/.backup"
)

for path in "${paths[@]}"; do
    url="http://target.com${path}"
    echo "[*] Testing: $url"
    scrabble "$url" -q
done

#!/bin/bash
# 自动化渗透测试脚本

DOMAIN="$1"

# 步骤1: 子域名枚举
echo "[*] Enumerating subdomains..."
subfinder -d "$DOMAIN" -silent > subdomains.txt

# 步骤2: Git 泄露扫描
echo "[*] Scanning for git leaks..."
cat subdomains.txt | parallel -j 20 \
    scrabble "http://{}" -q -o git_leaks.txt

# 步骤3: 下载发现的仓库
grep "Found" git_leaks.txt | awk '{print $3}' | while read url; do
    base_url=$(dirname "$url")
    output_dir="dumps/$(echo $base_url | sed 's/[^a-zA-Z0-9]/_/g')"

    echo "[*] Downloading: $base_url"
    githacker -u "$base_url" -o "$output_dir" -t 10
done

# 步骤4: 分析
echo "[*] Analyzing..."
grep -r "password\|secret\|api_key" dumps/ > sensitive.txt

# 检查 Go bin 路径
echo $GOPATH
ls $GOPATH/bin

# 添加到 PATH
export PATH=$PATH:$GOPATH/bin

# 或使用完整路径
$GOPATH/bin/scrabble http://target.com

# 增加超时时间
scrabble http://target.com -t 30

# 减少并发
scrabble http://target.com -c 5

# 检查网络连接
curl -I http://target.com/.git/config

# 手动验证
curl -I http://target.com/.git/config

# 使用详细输出查看详情
scrabble http://target.com -v

# 尝试直接下载验证
wget http://target.com/.git/config

# 减少并发和请求频率
scrabble http://target.com -c 1 -t 10

# 添加延迟（修改源码）
# 或使用其他工具

# 尝试不同路径变体
curl http://target.com/.git%2f/config
curl http://target.com/%2e%67%69%74/config

# Scrabble 目前不支持 --insecure 选项
# 临时解决方案:

# 方法1: 使用 HTTP 而非 HTTPS
scrabble http://target.com

# 方法2: 使用其他工具
git-dumper https://target.com/.git/ output --insecure

Scrabble: ~10MB 内存, <5% CPU
Python 工具: ~50MB 内存, ~15% CPU

# git-leak-scrabble.yaml
id: git-leak-detection

info:
  name: Git Configuration Disclosure
  severity: high

requests:
  - method: GET
    path:
      - "{{BaseURL}}/.git/config"
      - "{{BaseURL}}/.git/HEAD"

    matchers:
      - type: word
        words:
          - "[core]"
          - "repositoryformatversion"

#!/bin/bash
# 生成扫描报告

TARGETS="targets.txt"
OUTPUT="report_$(date +%Y%m%d).html"

cat > "$OUTPUT" << 'HTML'
<!DOCTYPE html>
<html>
<head><title>Git Leak Scan Report</title></head>
<body>
<h1>Git Leak Scan Results</h1>
<table border="1">
<tr><th>URL</th><th>Status</th></tr>
HTML

cat "$TARGETS" | while read domain; do
    result=$(scrabble "http://$domain" -q 2>&1)

    if echo "$result" | grep -q "Found"; then
        status="<span style='color:red'>VULNERABLE</span>"
    else
        status="<span style='color:green'>SAFE</span>"
    fi

    echo "<tr><td>$domain</td><td>$status</td></tr>" >> "$OUTPUT"
done

echo "</table></body></html>" >> "$OUTPUT"
echo "Report: $OUTPUT"

#!/bin/bash
# 先用 masscan 发现 Web 服务，再扫描 Git 泄露

# 步骤1: 扫描端口
masscan -p 80,443,8080,8443 10.0.0.0/24 \
    --rate 10000 \
    -oG masscan.txt

# 步骤2: 提取 IP:Port
cat masscan.txt | grep "Ports:" | awk '{print $2":"$5}' | sed 's/\/.*//g' > targets.txt

# 步骤3: 扫描 Git
cat targets.txt | parallel -j 50 scrabble "http://{}" -q -o git_findings.txt