Giter VIP home page Giter VIP logo

dvcs-ripper's Introduction

Rawsec's CyberSecurity Inventory GitHub stars GitHub license

dvcs-ripper

Rip web accessible (distributed) version control systems: SVN, GIT, Mercurial/hg, bzr, ...

It can rip repositories even when directory browsing is turned off.

Make sure to position yourself in empty directory where you want repositories to be downloaded/cloned.

Requirements

  • Perl
  • Perl modules:
    • required: LWP, IO::Socket::SSL
    • for newer SVN: DBD::SQlite and DBI
    • for faster GIT: Parallel::ForkManager, Redis and Algorithm::Combinatorics
  • (D)VCS client of what you want to rip (cvs, svn, git, hg, bzr, ...)

Requirements on Debian/Ubuntu

You can easily install perl requirements:

sudo apt-get install perl libio-socket-ssl-perl libdbd-sqlite3-perl libclass-dbi-perl libio-all-lwp-perl

Optional requirements (faster git rip): sudo apt-get install libparallel-forkmanager-perl libredis-perl libalgorithm-combinatorics-perl

And if you need all clients supported:

sudo apt-get install cvs subversion git bzr mercurial

Docker

In case you just want docker version, it is here:

https://github.com/kost/docker-webscan/tree/master/alpine-dvcs-ripper

Just say something like:

docker run --rm -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-git.pl -v -u http://www.example.org/.git

GIT

Example run (for git):

rip-git.pl -v -u http://www.example.com/.git/

It will automatically do git checkout -f

or if you would like to ignore SSL certification verification (with -s):

rip-git.pl -s -v -u http://www.example.com/.git/

Mercurial/HG

Example run (for hg):

rip-hg.pl -v -u http://www.example.com/.hg/

It will automatically do hg revert <file>

or if you would like to ignore SSL certification verification (with -s):

rip-hg.pl -s -v -u http://www.example.com/.hg/

Bazaar/bzr

Example run (for bzr):

rip-bzr.pl -v -u http://www.example.com/.bzr/

It will automatically do bzr revert

or if you would like to ignore SSL certification verification (with -s):

rip-bzr.pl -s -v -u http://www.example.com/.bzr/

SVN

It supports OLDER and NEWER version of svn client formats. Older is with .svn files in every directory, while newer version have single .svn directory and wc.db in .svn directory. It will automatically detect which format is used on the target.

Example run (for SVN):

rip-svn.pl -v -u http://www.example.com/.svn/

It will automatically do svn revert -R .

CVS

Example run (for CVS):

rip-cvs.pl -v -u http://www.example.com/CVS/

This will not rip CVS, but it will display useful info.

Advance usage examples

Some examples how it can be used

Output handling

Download git tree to specific output dir:

rip-git.pl -o /my/previously/made/dir -v -u http://www.example.com/.git/

Download git tree to specific output dir (creating dir http__www.example.com_.git_ for url):

rip-git.pl -m -o /dir -v -u http://www.example.com/.git/

Redis usage with docker

Create Redis docker container:

docker run --rm --name myredis -it -v /my/host/dir/data:/data:rw k0st/alpine-redis

In another terminal, just link redis container and say something like this:

docker run --rm --link=myredis:redis -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-git.pl -e docker -v -u http://www.example.org/.git -m -o /work

Using redis for resuming work of ripping

Create Redis docker container:

docker run --name redisdvcs -it -v /my/host/dir/data:/data:rw k0st/alpine-redis

In another terminal, just link redis container and say something like this:

docker run --link=redisdvcs:redis -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-git.pl -n -e docker -v -u http://www.example.org/.git -m -o /work

Abusing redis for massive parallel tasks

Create global NFS and mount /work on each client. Create global Redis docker container:

docker run --name redisdvcs -it -v /my/host/dir/data:/data:rw k0st/alpine-redis

In another terminal, just link redis container and say something like this on 1st client

docker run -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-git.pl -n -e global.docker.ip -v -u http://www.example.org/.git -t 10 -c -m -o /work

In another terminal, just link redis container and say something like this on 2nd client:

docker run -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-git.pl -n -e global.docker.ip -v -u http://www.example.org/.git -t 10 -c -m -o /work

and so on...

You need to perform git checkout -f yourself on the end - of course!

Future

Feel free to implement something and send pull request. Feel free to suggest any feature. Lot of features actually were implemented by request

ToDo

  • Recognize 404 pages which return 200 in SVN/CVS
  • Try to repeat each trick after previous trick was successful
  • Progress bars

Done

dvcs-ripper's People

Contributors

asutoshpalai avatar digininja avatar jkingsman avatar jwilk avatar kost avatar noraj avatar tarunkant avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

dvcs-ripper's Issues

Ignore SSL warnings

I tried using this on a site with a broken HTTPS cert, and it was throwing errors. You should probably ignore these errors instead.

Turn off SSL verification

Hi. Can you please turn off SSL verification? Or how can I use this tool over https?
Directory index is enabled and requested files 100% exists.
Here is my log:
➜ ../rip-git.pl -v -u https://qwe.to/.git/
[i] Downloading git files from https://qwe.to/.git/
[!] Not found for COMMIT_EDITMSG: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for config: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for description: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for HEAD: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for index: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for packed-refs: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects/info/alternates: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for info/grafts: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for logs/HEAD: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects/ve/rify: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects//: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects/pr/oblem: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects/va/riable: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects//: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects/di/sable: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects/va/riable: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for objects/wi/th: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[!] Not found for refs/heads/master: 500 Can't verify SSL peers without knowing which Certificate Authorities to trust
[i] Running git fsck to check for missing items
Checking object directories: 100% (256/256), done.
[i] Got items with git fsck: 0
[i] Items fetched: 0
Your branch is up-to-date with 'origin/master'.

Support git packs

When a git repo contains packed resources, rip-git.pl does not download the pack and only tries to download the objects directly, which will fail as such objects do not exist...

I tried to look around to see if it's possible to guess the name of the pack (when you can't list objects/pack) but so far nothing.

Do you think that's doable?

question on such an answer from the script

on one resource while testing as "black box", i found response for requests

https://xxx.example.com/revision.txt
https://xxx.example.com/revision.inc

I decided to try to pull out the repository by your tool, which already many times helped out on CTF quests.
And received such an answer:

[!] Not found for https://xxx.example.com///.svn/all-wcprops => /.svn/all-wcprops: 404 Not Found
[!] Not found for https://xxx.example.com///.svn/entries => /.svn/entries: 404 Not Found
[!] Not found for https://xxx.example.com///.svn/format => /.svn/format: 404 Not Found
[!] Not found for https://xxx.example.com///.svn/wc.db => /.svn/wc.db: 404 Not Found
[i] Found new SVN client storage format!
DBD::SQLite::db prepare failed: file is encrypted or is not a database at ./rip-svn.pl line 88.
Couldn't prepare statement 'SELECT id,root,uuid FROM repository': file is encrypted or is not a database at ./rip-svn.pl line 88.
Can't call method "execute" on an undefined value at ./rip-svn.pl line 89.

request:

./rip-svn.pl -vv -u https://xxx.example.com

Tell me, how to perceive, is there a repository and a file with a password? Or there is no repository?
Thank's

stuck on running git fsck to check

hi all,
I'm trying to rip git directory, but its stuck on 65% running git fsck to check missing items.

checking object directory : 65% (167/256)

how to solve this problem ?
Im using kali linux
stuck

issue

DBD::SQLite::db prepare failed: file is not a database at rip-svn.pl line 88.
Couldn't prepare statement 'SELECT id,root,uuid FROM repository': file is not a database at rip-svn.pl line 88.
Can't call method "execute" on an undefined value at rip-svn.pl line 89.

Create a folder for every site/project

It should create a new folder with the website name everytime that it's executed....

Otherwise I can't get more than 1 site.... Both create the .git folder....

The sqlmap project does this... it has a folder called output where it creates folders like "example.com", "google.com"*, ....

Thanks!

rip-cvs.pl file error

hello my friend

useing rip-cvs.pl

but
➜ dvcs-ripper git:(master) perl rip-cvs.pl
\C no longer supported in regex; marked by <-- HERE in m//\ <-- HERE CVS/ at rip-cvs.pl line 68.
➜ dvcs-ripper git:(master)

can you help me ?

Errors while downloading

../dvcs-ripper/rip-git.pl -s -v -u https://qwe.to/.git/
I got a bunch of other errors:

error: bad graft data:
error: Could not read 324324erewrewr
error: inflate: data stream error (incorrect header check)
error: unable to unpack 3432432efrdsfsdf header
error: inflate: data stream error (incorrect header check)
fatal: loose object 343243erewrew (stored in .git/objects/01/wr324324sdf) is corrupt

rip-git: inteligently guess name of packed refs

$ rip-git -v -u http://censored/.git/ -o repo2 -t 10 -g
[i] Downloading git files from http://censored/.git/
[i] Auto-detecting 404 as 200 with 3 requests
[i] Getting correct 404 responses
[i] Using session name: fFqxEqjj
[d] found COMMIT_EDITMSG
[d] found config
[d] found description
[d] found HEAD
[d] found index
[!] Not found for packed-refs: 404 Not Found
[!] Not found for objects/info/alternates: 404 Not Found
[!] Not found for info/grafts: 404 Not Found
[d] found logs/HEAD
[d] found objects/7e/126c5c6151f8dd36abda39f0d7cd13fdb4646f
[d] found objects/a5/7903d406eeb9e7b7d0095bf4534be15322929f
[d] found objects/e9/110f8730ae517674dcc09651eb570aae7de549
[d] found objects/f9/c6bf17ec7eb376fb50ebac935328623aedb0cc
[d] found objects/d9/0016c0a550394b2051d65a817f1e658aa65892
[d] found objects/6c/5d9264a4f05e2b7d753beda8d40f2f69a714c3
[d] found objects/c7/54ac17f47495e396913993ff48fd10eb70723e
[d] found objects/4f/863231bf62ae8e337df2cdb73832b8c9842011
[d] found objects/ff/fc3436fdc898c0bbff7e134c64ddcac4d4d7b8
[d] found objects/43/2edd2aca6787c882fa2ea3edf3f1c5e224c81e
[d] found objects/2c/66d164f4008c9b6d2dce7f3ee998042f7a7c7d
[d] found refs/heads/master
[!] Please install Parallel::Prefork CPAN module for parallel requests
[i] Running git fsck to check for missing items
Checking object directories: 100% (256/256), done.
[i] Got items with git fsck: 0, Items fetched: 0
[!] No more items to fetch. That's it!
[!] Performing intelligent guessing of packed refs
Undefined subroutine &main::permutations called at /usr/bin/rip-git line 404.

my $iter = permutations(\@missingitems);

rip-git: output dir behavior

for rip-git

-o <s> specify output dir works only if the output dir already exists. If it doesn't exist instead of creating it it will clone to the default ./.git/

perforce support, wut?

Don't know if you guys care because perforce isn't really used anywhere, but some time back when fbsd was putting all of their dev code into perforce, I needed some way to rip their repositories. Since it was proprietary but exposed a web-interface I threw some code together to snag it.

It's in python and using BeautifulSoup because python isn't as good for parsing everything as Perl is. https://github.com/arizvisa/dotfiles/blob/master/posix/bin/perforce-blows.py

If for some reason you use it and don't port it to perl and that license at the top conflicts with yours, I can remove the license. Anyways, take care.

Distribution Request

I am a developer for the ArchAssault project, we would like to add this to our repo, but we notice its missing a license. Can you add one to the repo please?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.