A penetration testing tool for selectively downloading files from exposed .git repositories on web servers.
PwnGitManager is a Python-based tool for security professionals to exploit exposed .git repositories on web servers during penetration tests. It enables targeted extraction of files like configuration files or source code without downloading the entire repository, reducing detection risk. The tool helps identify and retrieve sensitive data left accessible in misconfigured version control systems.
Penetration testers, red teamers, and security researchers who encounter exposed .git directories during web application assessments.
It offers a stealthier and more efficient alternative to tools like git-ripper by minimizing server requests and allowing precise file retrieval, which is crucial in real-world security engagements where alerting defenses is a concern.
Git manager for pentesters
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Downloads only the repository index first, then allows selective retrieval of specific files or paths, minimizing network requests and IDS alerts as emphasized in the README.
Offers both an interactive shell with autocomplete for ease of use and a command-line interface for scripting automated tasks, providing flexibility for different workflows.
Enables traffic routing through HTTP/HTTPS proxies to avoid detection, though the README notes SOCKS5 is not yet supported due to minimum requirements.
Provides remote control and file retrieval via a Telegram bot after installing python-telegram-bot, facilitating covert operations during security assessments.
SOCKS5 proxy support is missing, which can restrict stealth capabilities in environments where HTTP/HTTPS proxies are insufficient or blocked.
The TODO list admits gaps like lack of multithread downloads and database storage, impacting performance and scalability for larger repositories.
Requires Python 3 and additional packages like python-telegram-bot for full features, which may not align with all penetration testing setups or toolchains.