search

internetwache / GitTools

A repository with 3 tools for pwn'ing websites with .git repositories available
MIT License
3.87k stars 624 forks source link

Check for redirects and file type in `gitdumper.sh` #43

Open alexanderadam opened 4 years ago

alexanderadam commented 4 years ago

I tried a random example and it turned out that requests for various files (i.e. .git/packed-refs, .git/refs/wip/index/refs/heads/master, .git/refs/stash .git/refs/wip/wtree/refs/heads/master, .git/refs/remotes/origin/HEAD, .git/info/refs .git/objects/info/packs, .git/logs/refs/remotes/origin/HEAD) were affected by a HTTP rule. They were redirected to an index HTML file. So I guess two things should be considered here:

  1. Probably not to follow redirects
  2. Definitely check whether the result is HTML.

Otherwise it will look like this:

fatal: unexpected line in .git/packed-refs: </html>?

PS: Thank you for your work!

gehaxelt commented 3 years ago

Hey @alexanderadam and @xavior1412, I've implemented

Could you please check if that works and fixes your issues?

[0] https://github.com/internetwache/GitTools/tree/dev

alexanderadam commented 3 years ago

I wow. I totally forgot about this issue and I don't know where this cases appeared :see_no_evil: Should I close this issue?

gehaxelt commented 3 years ago

Yeah, sorry for the delay on this one. I'd wait for xavior for a few days and then merge the new features.