A bug hunting tool that scans websites for exposed .git repositories and dumps their contents for security analysis.
Git Scanner Framework is a security tool that scans websites for publicly accessible .git repositories, which can expose sensitive source code and configuration files. It helps bug hunters and penetration testers identify and dump these repositories to analyze for security vulnerabilities. The tool supports scanning single targets or mass target lists from a file.
Bug hunters, penetration testers, and security researchers who need to identify and analyze exposed Git repositories on web servers for security assessments.
Developers choose Git Scanner Framework for its focused functionality, ease of use via a Bash script, and ability to both detect and dump exposed .git repositories in one tool, streamlining the process of uncovering accidental source code exposures.
A tool for bug hunting or pentesting for targeting websites that have open .git repositories available in public
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The interactive Bash menu simplifies operation, allowing users to choose between scanning, dumping, or extracting without memorizing complex commands, as shown in the usage section with numbered menus.
It can dump entire .git repositories from vulnerable servers, enabling full source code analysis for security assessments, with modes for scanning only, dumping only, or combined operations.
Supports both single URLs and file-based mass target lists, making it adaptable for various scanning scenarios, as emphasized in the URL format instructions.
Requires only basic tools like curl, bash, git, and sed, with minimal setup via git clone or system installation, reducing dependency overhead.
Lack of multi-processing support, as noted in the TODO list, means scans can be slow on extensive target lists, relying on sequential Bash operations.
The file extractor is labeled as experimental in the README, which may lead to unreliable or incomplete file recovery from dumped .git repositories.
Focuses solely on .git directory exposure, missing other version control systems or broader security vulnerabilities, which restricts its utility in comprehensive pentests.