Exposed Git Repositories

OWASP A3:2017-Sensitive Data Exposure

Theory

The exposure of Git repositories on a webserver often occurs due to misconfigurations, where the .git directory is left accessible without proper access controls.

If we encounter an application with an exposed .git directory, we can retrieve the entire repository. This enables us to extract valuable information, such as the remote repository address, commit history, logs, and various metadata. Accessing these details may reveal sensitive data, including proprietary code, hard-coded API keys, and credentials, which can then be leveraged to escalate our attack and further compromise the application's security.

Practice

Enumeration

To detect exposed Git repositories, we can utilize tools and commands below.

httpx

We may use httpx to identify exposed repositories across a list of domains using the command below. It checks if the .git/HEAD file contains refs/heads .

Note that this one-liner will only identify repositories if directory listing is enabled.

cat domains.txt | httpx -path /.git/HEAD -silent -mr "refs/heads"

Feroxbuster

Google Dorks

Gitfinder

Dump

Once an exposed Git repository is identified, the next step is to perform a repository dump to extract its contents.

GitTools

gitdumper from GitTools can be used to download as much as possible from the found .git repository from webservers which do not have directory listing enabled.

./gitdumper.sh http://target.com/.git/ dest-dir

extractor.sh from GitTools can then be used in combination with gitdumper in case the downloaded repository is incomplete. This tool extract commits and their content from a broken repository.

./extractor.sh /tmp/mygitrepo /tmp/mygitrepodump

GitHacker

goop

git-dumper

Hunting

After successfully dumping an exposed Git repository, the next step is to hunt for valuable secrets within the retrieved data.

Hard-coded Secrets

Noseyparker

Noseyparker is a command-line program that finds secrets and sensitive information in textual data and Git history. We can use this tool to recursively search sensitive information in a repository.

# Scan filesystem / folder
noseyparker scan --datastore np.myDataStore /path/to/gitRepo

# Get results
noseyparker report -d np.myDataStore

You may use this tools to search sensitives files in a mounted NFS share, a mounted SMB share, or even exiltrated data.

Bash

Alternatively, find command can be use to find configuration files by recursively searching files with a specific extension or name and the grep command can be use to find passwords in files by recursively searching text patterns.

# Search for patterns in file
grep -ari 'password'
grep -ari 'api_key'
grep -ari 'api_key'

# Search for configuration/sensitive files
find / -type f -name *.conf 2>/dev/null
find / -type f -name *pass* 2>/dev/null

Origin

Commit History

Resources

OWASP Top Ten 2017 | A3:2017-Sensitive Data Exposure | OWASP Foundationowasp.org

Git Exposed — How to Identify and ExploitMedium

Exposed .git Directory ExploitationMedium