super-l / superl-githack Goto Github PK

View Code? Open in Web Editor NEW

43.0 2.0 11.0 1.22 MB

.git信息泄露漏洞利用工具。可以打包完整的各个版本项目开发代码，历程。与GitHack不同的是，这个下载的更完整无错！

Python 100.00%

superl-githack's Introduction

程序简介

.git信息泄露漏洞利用工具，程序主要运用于WEB安全脆弱性测试~~ 与李姐姐的GitHack有所不同。之所以写这个小工具，主要是因为在使用李姐姐的GitHack时候，发现提示很多文件找不到，导致打包的代码严重丢失，不完整。但缺点同样明显，需要本地git客户端。

当前版本

Version 1.0

特点说明

1：可自动完整的下载整个项目GIT工程文件；

2：可获得从git项目创建以来的所有更新历程和源代码；

3：下载的代码完整(在使用李姐姐的GitHack时候，发现提示很多文件找不到)

4：同时支持python2和python3运行；

使用方法

判断网站是否存在.git泄露漏洞；

运行：python superl-githack.py http://www.xxx.com/.git/

之后会在工具的当前目录下生成git目录，里面存放该网站的git文件，如图：

随便使用一款带git版本控制的IDE，如phpstrom,intellij IDEA,Clion,Pycharm等，创建一个空的项目，如图：

在当前空工程路径下使用git init命令初始化git功能（会自动创建一个.git目录;

删除空工程的.git目录下的所有文件，把我们下载到的git目录中的文件，全部复制粘贴过去；

重新打开IDE，就会自动加载新的git开发版本记录，如图；

使用效果

测试环境系统为Mac Pro 10.12

测试环境python版本为2.7

如果提示模块不存在，请自行pip安装！

如果使用遇到问题，可以留言。

superl-githack's People

Contributors

Stargazers

Watchers

Forkers

nnewkin ifishzz sry309 0xsh4dow on1sm deepwebhacker dxd214 javalangclass mygit2014 zzhsec

superl-githack's Issues

urllib2.HTTPError: HTTP Error 403: Forbidden

Traceback (most recent call last):
File "superl-githack.py", line 138, in
save(url)
File "superl-githack.py", line 84, in save
content = getHtmlContent(url)
File "superl-githack.py", line 51, in getHtmlContent
response = urllib2.urlopen(req, timeout=30)
File "/usr/lib/python2.7/urllib2.py", line 154, in urlopen
return opener.open(url, data, timeout)
File "/usr/lib/python2.7/urllib2.py", line 435, in open
response = meth(req, response)
File "/usr/lib/python2.7/urllib2.py", line 548, in http_response
'http', request, response, code, msg, hdrs)
File "/usr/lib/python2.7/urllib2.py", line 473, in error
return self._call_chain(*args)
File "/usr/lib/python2.7/urllib2.py", line 407, in _call_chain
result = func(*args)
File "/usr/lib/python2.7/urllib2.py", line 556, in http_error_default
raise HTTPError(req.get_full_url(), code, msg, hdrs, fp)
urllib2.HTTPError: HTTP Error 403: Forbidden

神奇的脚本

Usage: python superl-githack.py http://www.xxx.com/.git/
这个用例是怎么来的..

而且好像并不能用的说

python3完美报错

求大佬修复

不支持ip?

please input .git url:https://xx.x.x.x:380xxx/.git/
Traceback (most recent call last):
File "superl-githack.py", line 134, in
save(url)
File "superl-githack.py", line 80, in save
content = getHtmlContent(url)
File "superl-githack.py", line 44, in getHtmlContent
response = urllib.request.urlopen(req, timeout=10)
File "D:\Program Files\Python36\lib\urllib\request.py", line 223, in urlopen
return opener.open(url, data, timeout)
File "D:\Program Files\Python36\lib\urllib\request.py", line 526, in open
response = self._open(req, data)
File "D:\Program Files\Python36\lib\urllib\request.py", line 544, in _open
'_open', req)
File "D:\Program Files\Python36\lib\urllib\request.py", line 504, in _call_chain
result = func(args)
File "D:\Program Files\Python36\lib\urllib\request.py", line 1361, in https_open
context=self._context, check_hostname=self._check_hostname)
File "D:\Program Files\Python36\lib\urllib\request.py", line 1318, in do_open
encode_chunked=req.has_header('Transfer-encoding'))
File "D:\Program Files\Python36\lib\http\client.py", line 1239, in request
self._send_request(method, url, body, headers, encode_chunked)
File "D:\Program Files\Python36\lib\http\client.py", line 1285, in _send_request
self.endheaders(body, encode_chunked=encode_chunked)
File "D:\Program Files\Python36\lib\http\client.py", line 1234, in endheaders
self._send_output(message_body, encode_chunked=encode_chunked)
File "D:\Program Files\Python36\lib\http\client.py", line 1026, in _send_output
self.send(msg)
File "D:\Program Files\Python36\lib\http\client.py", line 964, in send
self.connect()
File "D:\Program Files\Python36\lib\http\client.py", line 1400, in connect
server_hostname=server_hostname)
File "D:\Program Files\Python36\lib\ssl.py", line 407, in wrap_socket
_context=self, _session=session)
File "D:\Program Files\Python36\lib\ssl.py", line 817, in init
self.do_handshake()
File "D:\Program Files\Python36\lib\ssl.py", line 1077, in do_handshake
self._sslobj.do_handshake()
File "D:\Program Files\Python36\lib\ssl.py", line 694, in do_handshake
match_hostname(self.getpeercert(), self.server_hostname)
File "D:\Program Files\Python36\lib\ssl.py", line 327, in match_hostname
% (hostname, ', '.join(map(repr, dnsnames))))
ssl.CertificateError: hostname 'xxx.xx.xx.xxx' doesn't match either of '.91rong.com.cn', '91rong.com.cn'