I'm pen-testing an application with a bug bounty program.
I've found a .git folder which just gives a 403 forbidden error.
However, when browsing to directories such as dodgy.com/.git/config
, the file will download.
I discovered this a few hours ago and figured I would try to create a bash script which 'blindly' downloads a git repo.
Obviously I can just report the current findings, however it would be great to see how much information I can pull.
So far this script:
- Downloads all standard files known to git (for example,
/refs/heads/master
) - Uses
cat /refs/heads/master
to find the head commit - Downloads the head commit by generating the relevant
object
directory structure- For example, if a commit is
4b5a29b99bcb8b007c2f3932c9a49662aab1505e
, the object will be saved at/objects/4b/5a29b99bcb8b007c2f3932c9a49662aab1505e
. - This allows
- finding the object file blindly,
- generating the correct local directory structure.
- For example, if a commit is
- For each commit found, downloads the next commit by parsing errors shown by
git log
Steps 3 and 4 are repeated to download trees, which can be found by running git show xyz
, and parsing the error message generated...
The only thing missing (as far as I know from limited research) is downloading a .pack file.
Git stores most of its history in a file at /objects/pack/pack-{sha1}.pack
.
From my research, I cannot see how to generate the sha1 without full access to a git repo.
Is it possible to generate a .pack file name from an incomplete number of commit and tree object files?
The more I read the more I feel impossible. Relevant info here.