[B! .git] ishideoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ishideo id:ishideo

.gitã«é–¢ã™ã‚‹ishideoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (15)

${{author_name}}$

{{author_name}} {{created}}

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

{{#following_bookmarks}}

${{author_name}}$

{{author_name}} {{created}}

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

{{/following_bookmarks}}

{{/is_wiped}}

Learning the internals of Git by hacking websites
ishideo 2023/01/04
.git

git

object

internal
ãƒªãƒ³ã‚¯
Gitã®ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã®ä¸èº«
ã¯ã˜ã‚ã« Gitã®ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹ã®ä¸èº«ã€Gitã®ãƒ–ãƒ©ãƒ³ãƒã®å®Ÿè£…ã«ç¶šãã€Gitã®ä¸èº«ã‚’è¦‹ã¦ã¿ã‚ˆã†ã‚·ãƒªãƒ¼ã‚ºã§ã™ã€‚GitãŒç®¡ç†ã™ã‚‹ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã®ç¨®é¡žã‚„ä¸èº«ã«ã¤ã„ã¦è¦‹ã¦ã¿ã¾ã™ã€‚åŸºæœ¬çš„ã«ã¯Pro Gitã®10. Gitã®å†…å´ã‚’ã¾ã¨ã‚ãªãŠã—ãŸã‚‚ã®ã§ã™ã€‚ ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã®ç¨®é¡ž Gitã¯ã€å†…éƒ¨ã§ãƒ•ã‚¡ã‚¤ãƒ«ã‚„ã‚³ãƒŸãƒƒãƒˆã‚’ã€Œã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã€ã¨ã—ã¦.git/objectsä»¥ä¸‹ã«ä¿å˜ã—ã¦ã„ã¾ã™ã€‚ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã«ã¯ä»¥ä¸‹ã®4ç¨®é¡žãŒã‚ã‚Šã¾ã™ã€‚ blobã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆï¼š ãƒ•ã‚¡ã‚¤ãƒ«ã‚’åœ§ç¸®ã—ãŸã‚‚ã®ã€‚ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã®ã€Œãƒ•ã‚¡ã‚¤ãƒ«ã€ã«å¯¾å¿œ treeã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆï¼š Blobã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚„åˆ¥ã®Treeã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚’ç®¡ç†ã™ã‚‹ã€‚ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã®ã€Œãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã€ã«å¯¾å¿œ ã‚³ãƒŸãƒƒãƒˆã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆï¼š Treeã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚’åŒ…ã‚“ã ã‚‚ã®ã€‚ã‚³ãƒŸãƒƒãƒˆã®ã‚¹ãƒŠãƒƒãƒ—ã‚·ãƒ§ãƒƒãƒˆã«å¯¾å¿œã™ã‚‹Treeã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã«ã€è¦ªã‚³ãƒŸãƒƒãƒˆã€ã‚³ãƒŸãƒƒãƒˆãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ãªã©ã‚’ä»˜åŠ ã™ã‚‹ ã‚¿ã‚°ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆï¼š
ishideo 2022/11/18
git

.git

objects

tree

tag

blob

commit

cat-file

zenn
ãƒªãƒ³ã‚¯
How to restore the project if I have only .git folder?
ishideo 2022/11/17
.git

git

folder

restore

repository

stackoverflow

reset

--hard
ãƒªãƒ³ã‚¯
.gitãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã®ä¸èº«ã‚’è¦‹ã¦ã¿ã‚‹ðŸ‘€ - Qiita
git init ã‚’ã™ã‚‹ã¨ã€ .git ã¨è¨€ã†ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãŒä½œã‚‰ã‚Œã¾ã™ã€‚ Gitã«å¿…è¦ãªãƒ•ã‚¡ã‚¤ãƒ«ã¯å…¨ã¦ã“ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«å«ã¾ã‚Œã¦ã„ã‚‹ã®ã§ã™ãŒã€æ™®æ®µã¯ã‚ã¾ã‚Šæ„è˜ã—ãªã„äººã®æ–¹ãŒå¤šã„ã¨æ€ã„ã¾ã™ã€‚ ä»Šå›žã¯ .git ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã®ä¸èº«ã‚’å°‘ã—æŽ¢æ¤œã—ã¦ã¿ã¾ã—ã‚‡ã†ã€‚ .gitãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã®æ§‹æˆ ã¾ãšã¯ git init ã—ã¦ .git ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã‚’ä½œæˆã—ã¦ã¿ã¾ã™ã€‚ .git ã®ä¸èº«ã¯ã“ã®ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ . â”œâ”€â”€ HEAD â”œâ”€â”€ branches â”œâ”€â”€ config â”œâ”€â”€ description â”œâ”€â”€ hooks â”‚ â”œâ”€â”€ applypatch-msg.sample â”‚ â”œâ”€â”€ commit-msg.sample â”‚ â”œâ”€â”€ fsmonitor-watchman.sample â”‚ â”œâ”€â”€ post-update.sample â”‚ â”œâ”€â”€ pre-applypatch.sample â”‚
ishideo 2022/11/17
git

.git

tree

cat-file

object

hash

qiita
ãƒªãƒ³ã‚¯
Gitã®ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆãƒãƒƒã‚·ãƒ¥ã®è¨ˆç®—æ–¹æ³•
Git ã®ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆ æœ€åˆã«å°‘ã—ã ã‘Gitã®ãƒ‡ãƒ¼ã‚¿(ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆ)ã®ä¿å˜æ–¹æ³•ã«ã¤ã„ã¦è§¦ã‚Œã¾ã™ã€‚ ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã¯ .git/objects/ ã«ä¿å˜ã•ã‚Œã¾ã™ã€‚ ã“ã®ä¸ã«ãƒªãƒã‚¸ãƒˆãƒªã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’åŠ¹çŽ‡çš„ã«ä¿å˜ã—ã¾ã™ã€‚ ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã”ã¨ã«åŒã˜ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é‡è¤‡ã—ã¦ä¿å˜ã™ã‚‹ã“ã¨ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ ãƒ•ã‚¡ã‚¤ãƒ«ã ã‘ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ï¼”ç¨®é¡žã®ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚’ä¿å˜ã—ã¾ã™ã€‚ blob: Binary Large OBjecctã®ç•¥ã§ã€ã¤ã¾ã‚Šã¯ãƒ•ã‚¡ã‚¤ãƒ«ã§ã™ã€‚ã—ã‹ã—ã€ãƒ•ã‚¡ã‚¤ãƒ«åã¯å«ã¿ã¾ã›ã‚“ã€‚ tree: ï¼‘éšŽå±¤åˆ†ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã®å…¨ãƒ•ã‚¡ã‚¤ãƒ«åã¨ãƒ•ã‚¡ã‚¤ãƒ«å†…å®¹ã®ãƒãƒƒã‚·ãƒ¥ã¨æ¨©é™ã§ã™ã€‚ commit: git commit ã§ä½œã‚‰ã‚Œã¾ã™ã€‚ã‚³ãƒŸãƒƒãƒˆå†…å®¹ã¨ã‹ä½œæˆè€…ã€ä½œæˆæ—¥æ™‚ãªã©ãŒå«ã¾ã‚Œã¾ã™ã€‚ã‚³ãƒŸãƒƒãƒˆãƒãƒƒã‚·ãƒ¥ã‚„ã‚³ãƒŸãƒƒãƒˆSHAã¨å‘¼ã°ã‚Œã‚‹ã‚‚ã®ã§ã™ã€‚ tag: git tag ã§ä½œã‚‰ã‚Œã¾ã™ã€‚æœ¬è³ªçš„ã«ã¯ commit ã¨ã‚ã¾ã‚Šå¤‰ã‚ã‚Šã¾ã›ã‚“ã€‚ ãªãœã€é‡è¤‡
ishideo 2022/11/17
git

object

hash

hexdump

cat-file

tree

blob

.git

zenn
ãƒªãƒ³ã‚¯
Unprotected .git folders on the internet pose a security risk
ishideo 2022/11/09
.git

switzerland

credential

csirt

vulnerability

threat

.env

ds_store

misconfiguration

leakage
ãƒªãƒ³ã‚¯
GitHub - HightechSec/git-scanner: A tool for bug hunting or pentesting for targeting websites that have open .git repositories available in public
ishideo 2022/03/27
.git

git

cli

github

pentest

bash
ãƒªãƒ³ã‚¯
LeakIX
ishideo 2021/10/04
leakix

leak

.git

phpinfo

.env

misconfiguration

ip

cidr

detect

webservice
ãƒªãƒ³ã‚¯
å¤–éƒ¨å…¬é–‹ã™ã‚‹Dockerã‚¤ãƒ¡ãƒ¼ã‚¸ã‚’ä½œã‚‹ã¨ãã¯ COPY . ã«æ°—ã‚’ã¤ã‘ã‚ˆã†
English article is here. è¦ç´„ä»¥ä¸‹ã®æ¡ä»¶ã‚’æº€ãŸã™ã¨ãã«Dockerã‚¤ãƒ¡ãƒ¼ã‚¸å†…ã«æ®‹ç•™ã™ã‚‹.gitãƒ•ã‚©ãƒ«ãƒ€ãƒ¼ã‹ã‚‰æ©Ÿå¯†æƒ…å ±ãŒæµå‡ºã™ã‚‹æã‚ŒãŒã‚ã‚Šã¾ã™ã€‚ éŽåŽ»ã«æ©Ÿå¯†æƒ…å ±ã‚’commitã—ãŸãŒæ¶ˆã—ã¦ã„ãªã„.gitãƒ•ã‚©ãƒ«ãƒ€ãƒ¼ã¨DockerfileãŒåŒã˜éšŽå±¤ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«ã‚ã‚‹Dockerfileã§COPYã‚„ADDå‘½ä»¤ã§ã‚«ãƒ¬ãƒ³ãƒˆãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã‚’æŒ‡å®šã—ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ç§»ã—ã¦ã„ã‚‹(ä¾‹ : COPY . /app)Dockerã‚¤ãƒ¡ãƒ¼ã‚¸ã‚’èª°ã§ã‚‚ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã§ãã‚‹å ´æ‰€ã«ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã™ã‚‹Dockerfileã‚’å¤‰æ›´ã›ãšã«ã§ãã‚‹å¯¾ç–ã¨ã—ã¦ã¯ .dockerignoreãƒ•ã‚¡ã‚¤ãƒ«ã§.gitãƒ•ã‚©ãƒ«ãƒ€ãƒ¼ã‚’æŒ‡å®šã™ã‚‹ãŒæŒ™ã’ã‚‰ã‚Œã¾ã™ã€‚ WaniCTF'21-spring ã€ŒGit Masterã€4/30 ~ 5/2ã«å¤§é˜ªå¤§å¦CTFã‚µãƒ¼ã‚¯ãƒ«Wani HackaseãŒé–‹å‚¬ã—ãŸåˆå¿ƒè€…å‘ã‘ã®CTFå¤§ä¼šWaniCTF'21-sp
ishideo 2021/05/24
security

vulnerability

docker

dockerfile

copy

add

.dockerignore

.git

credential

secret
ãƒªãƒ³ã‚¯
GitHub - arthaud/git-dumper: A tool to dump a git repository from a website
ishideo 2021/04/08
git-dumper

git

.git

repository

recon

vulnerability

github

leak

python

sensitive-data
ãƒªãƒ³ã‚¯
GitHub - nyancrimew/goop: Yet another tool to dump a git repository from a website, focused on as-complete-as-possible dumps and handling weird edge-cases.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
ishideo 2021/04/08
goop

git

.git

repository

recon

vulnerability

github

leak

golang

sensitive-data
ãƒªãƒ³ã‚¯
Leaking Git Repositories From Misconfigured Sites
ishideo 2021/03/26
.git

leak

sensitive-data

git

wget

misconfigured

gitjacker

exposed

--no-parent

pentest
ãƒªãƒ³ã‚¯
Popular travel apps are exposing sensitive data of millions of users, report
ishideo 2021/03/26
sensitive

.git

git

critical

leak

security

vulnerability
ãƒªãƒ³ã‚¯
GitHub - lijiejie/GitHack: A `.git` folder disclosure exploit
ishideo 2020/09/29
git

.git

vulnerability

security

exploit

disclosure

github

python
ãƒªãƒ³ã‚¯
GitHub - liamg/gitjacker: ðŸ”ª Leak git repositories from misconfigured websites
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
ishideo 2020/09/29
git

gitjacker

pentest

security

leak

secret

credential

github

golang

.git
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@HatenaBookmark
ãƒªãƒªãƒ¼ã‚¹ã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“ã‚¹ã®ãŠçŸ¥ã‚‰ã›
@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx