.git/ 폴더 유출: 쉬운 익스플로잇

왕이항 / GitHacker

🕷️ 숨김, 공통 분기, 공통 태그를 포함하여 전체 Git 저장소를 복원할 수 있는 `.git` 폴더 악용 도구입니다.

GitHacker

설명

선언문(중요)

Several VULNERABILITIES have been reported recently, if you are using GitHacker <= 1.1.0, please update your tool as soon as possible.

요구 사항

Docker에서의 사용(권장)

# print help info
docker run wangyihang/githacker --help
# quick start
docker run -v $(pwd)

Anyone can use automated scripts such as the above repository to download your source code and view the entire git history. Git is also a filesystem that follows some conventions, so you can guess directories and files easily.

Most projects use master or main as master branch, so it's easy to guess "hidden" paths in the /.git/ folder. Note that the tool can even brute force branches and tags if that's necessary.

If the scan succeeds, you get a result folder on your local machine (you can customize the folder name with the --output-dir option).

A typical result is the equivalent of git checkout master for free!

.git/ 폴더를 배포하지 않거나 최소한 액세스를 금지합니다.

The .git/ folder can contain lots of information, including the source code itself but also names, mails, and, in the worst-case scenario, hard coded credentials (e.g. databases, tokens, keys).

For a hacker, it's like Christmas!

You should completely disable public access to such folder. Modern CI/CD and deployment solutions are relatively easy to configure and allow cleaning such directories that have nothing to do with the production environment.

Note that some web hosting providers disable access to the folder for security purpose, but it's not always the case and it's not the default configuration, so check it before deploying anything.

I recommend doing all hardenings available. While it might seem a bit overkill, it's often a good idea to take into account any misconfiguration that could occur in the future or a miscalculated migration, so:

1. Disable public access in the .git/ folder by default on your server
2. Add a rule to forbid access to the folder in your source code, for example, in the .htaccess file for Apache configurations
3. Don't even deploy such folder in public directories if that's possible

If you don't want to touch sensitive files such as the .htaccess, you can add a smaller .htaccess at the root of the .git/ folder on your server with just the following line inside:

Deny from all

RedirectMatch 404 /\.git