Customize Consent Preferences

We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below.

The cookies that are categorized as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ... 

Always Active

Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

No cookies to display.

Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

No cookies to display.

Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

No cookies to display.

Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.

No cookies to display.

Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyze the effectiveness of the ad campaigns.

No cookies to display.

開源套件 – 挖掘網站git漏洞 – GitTools

惡意人員可以使用工具下載/還原存儲庫,以訪問您的網站的源代碼。現在檢查您的Web服務器的配置,並確保它阻止對這些文件夾的訪問。

什麼是版本控制系統?

幾十年前,程序員面臨著一個嚴重的問題-(遠程)一起開發工具。為了更改此設置,創建了版本控制系統(VCS)。這些的主要任務是使在一個代碼庫上的分佈式工作成為可能。這可以通過跟踪每個代碼更改(通常稱為提交)來實現。一種git臭名昭著的萊納斯·托瓦爾茲(Linus Torvalds )稱之為並維護著一種著名的VCS 。您可能還聽說過在線代碼託管平台github.com,該平台可以託管您的git存儲庫。

工具

https://github.com/internetwache/GitTools

其中包含三個小工具

  1. Finder 此python腳本標識具有可公開訪問的.git存儲庫的網站。它檢查.git/HEAD文件是否包含refs/heads
  2. Dumper 該工具可用於從未啟用目錄列表的Web服務器從找到的.git存儲庫中下載盡可能多的文件。
  3. Extractor 從損壞的存儲庫中提取提交及其內容。

使用方法

$ ./gitfinder.py -h

###########
# Finder is part of https://github.com/internetwache/GitTools
#
# Developed and maintained by @gehaxelt from @internetwache
#
# Use at your own risk. Usage might be illegal in certain circumstances.
# Only for educational purposes!
###########

usage: gitfinder.py [-h] [-i INPUTFILE] [-o OUTPUTFILE] [-t THREADS]

optional arguments:
  -h, --help            show this help message and exit
  -i INPUTFILE, --inputfile INPUTFILE
                        input file
  -o OUTPUTFILE, --outputfile OUTPUTFILE
                        output file
  -t THREADS, --threads THREADS
                        threads
$ ./gitdumper.sh -h

[*] USAGE: http://target.tld/.git/ dest-dir [--git-dir=otherdir]
		--git-dir=otherdir		Change the git folder name. Default: .git
./extractor.sh /tmp/mygitrepo /tmp/mygitrepodump

AIS3 2020 曾出現 Elephants 就需要下載 .git 進行分析。

Back To Top
error: 內容被保護 !!
Buy Me A Coffee
歡迎贊助 sectools.tw 讓這個網站更好~!