A Perl toolkit for ripping web-accessible version control repositories (Git, SVN, Mercurial, Bazaar, CVS) even when directory browsing is disabled.
dvcs-ripper is a security-oriented Perl toolkit that extracts source code from web-accessible version control repositories like Git, SVN, Mercurial, Bazaar, and CVS. It is designed to recover repository contents even when directory browsing is disabled on the server, making it useful for identifying exposed source code during security assessments. The tool automates the ripping process and supports features like parallel processing and SSL bypass.
Security researchers, penetration testers, and red teamers who need to identify and extract exposed version control repositories during web application assessments. It is also suitable for developers auditing their own servers for accidental repository exposures.
Developers choose dvcs-ripper for its comprehensive multi-VCS support, ability to bypass disabled directory browsing, and practical features like Docker deployment and Redis-backed parallel processing. Its focus on reliability and ease of use in security testing scenarios makes it a preferred tool over manual extraction methods.
Rip web accessible (distributed) version control systems: SVN/GIT/HG...
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports Git, SVN, Mercurial, Bazaar, and CVS with dedicated scripts (e.g., rip-git.pl, rip-svn.pl), making it versatile for various repository types.
Can extract repositories even when web server directory browsing is disabled, a core feature highlighted in the description and README.
Automatically runs checkout/revert commands like 'git checkout -f' or 'svn revert -R .' after ripping, reducing manual steps.
Offers official Docker images for easy deployment and uses Redis for parallel processing and resumable operations, as detailed in advance usage examples.
Requires specific Perl modules (e.g., LWP, DBD::SQlite for newer SVN) that may not be pre-installed, adding setup overhead on non-Debian systems.
Enabling parallel processing involves multi-step Docker and Redis configuration, such as creating and linking containers, which can be cumbersome for casual users.
The README admits limitations like struggling to recognize 404 pages that return 200 in SVN/CVS, which can affect reliability in edge cases.