41 lines
1.4 KiB
Bash
Executable File
41 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 17: .git Repository Exposure
|
|
# Desc: Exposed .git directory leaking source code
|
|
# Detect: Any web server
|
|
# Severity: CRITICAL
|
|
# Tools: curl, git
|
|
|
|
vector_gitex() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
|
|
|
|
print_info "Checking .git exposure..."
|
|
|
|
local git_url="${base}/.git/HEAD"
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$git_url" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "ref: refs/heads/\|refs/heads/master\|refs/heads/main"; then
|
|
print_find ".git HEAD exposed!" "Full git repo may be downloadable at $base/.git/"
|
|
|
|
# Check more .git files
|
|
local config=$(curl -s --connect-timeout 5 --max-time 10 "${base}/.git/config" 2>/dev/null)
|
|
local objects_check=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${base}/.git/objects" 2>/dev/null)
|
|
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: .git Repository Exposure
|
|
DETAIL: Complete .git directory exposed at ${base}/.git/
|
|
EVIDENCE: .git/HEAD accessible with content: $response
|
|
EXPLOIT: Use git-dumper: git-dumper $base/.git/ ./repo-out/
|
|
Or: wget -r $base/.git/" > "$REPORTS_DIR/.finding_$(date +%s)_git-exposure.txt"
|
|
findings=$((findings + 1))
|
|
|
|
print_info "Use: git-dumper $base/.git/ ./repo/"
|
|
else
|
|
print_skip "No .git exposure detected"
|
|
fi
|
|
|
|
return $findings
|
|
}
|