GitDump dumps the source code from .git when the directory traversal (https://www.kitploit.com/search/label/Directory%20Traversal) is disabled
Requirements
Python3
Tested on
Windows Kali Linux
What it does
Dump source code from website/.git directory when directory traversal is disabled.
How it works
Fetch all common files (.git/index, .git/HEAD, .git/ORIG_HEAD, etc.). Find as many objects (sha1) as possible by analyzing .git/packed-refs, .git/index, etc. Download idx and pack files. Now you can run git checkout -- . to retrieve source code.
How to Use
python3 git-dump.py https://website.com/.git/ Create the output directory and dump all the .git files in it. After running above script type: cd output && git checkout -- . It will recover all source code.
TODO
Search through git repository for secrets (https://www.kitploit.com/search/label/Secrets) by digging deep into commit history (https://www.kitploit.com/search/label/History) and branches. Credits Sean B. Palmer for his index file parser. (https://github.com/sbp/gin)

Download GitDump (https://github.com/Ebryx/GitDump)

Hacking Articles
Meterpreter for Pentester: Sessions

In this series of articles, we will be focusing on the various mechanisms of the Metasploit Framework that can be used by Penetration Testers. Today we are going to learn about the session’s command of the Metasploit Framework.  Sessions command helps us to interact and manipulate the various sessions created

The post Meterpreter for Pentester: Sessions appeared first on Hacking Articles.

Dark Reading: Attacks/Breaches
Autonomous Security Is Essential if the Edge Is to Scale Properly

Service demands at the network edge mean customers need to get cost, performance, and security right.

Kali Linux Tutorials
WAF-A-MoLE : A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls

WAF-A-MoLE is a guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool for assessing the robustness of your product by letting WAF-A-MoLE […]

The post WAF-A-MoLE : A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
S3-Account-Search : S3 Account Search

S3-Account-Search tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket (s3:getObject). Permission to list the contents of the bucket (s3:ListBucket). Additionally, you will need a role that you can […]

The post S3-Account-Search : S3 Account Search appeared first on Kali Linux Tutorials.

Introduction to Empire 4.0
https://www.reddit.com/r/redteamsec/comments/ofh750/introduction_to_empire_40/

submitted by /u/DLLCoolJ (https://www.reddit.com/user/DLLCoolJ)
[link] (https://youtu.be/zFlsxrGMScE) [comments] (https://www.reddit.com/r/redteamsec/comments/ofh750/introduction_to_empire_40/)

KitPloit - PenTest Tools!
GitDump - A Pentesting Tool That Dumps The Source Code From .Git Even When The Directory Traversal Is Disabled

https://1.bp.blogspot.com/-FSNANG-Fi0E/YN5oTHMZrcI/AAAAAAAAfkc/-ZgohKgHw_IPd2jvPrLHtPGulW4iqyHugCNcBGAsYHQ/w640-h528/GitDump_3_poc.png
GitDump dumps the source code from .git when the directory traversal is disabled
Requirements

* Python3

Tested on

* Windows
* Kali Linux

What it does

* Dump source code from website/.git directory when directory traversal is disabled.

How it works

* Fetch all common files (.git/index, .git/HEAD, .git/ORIG_HEAD, etc.).
* Find as many objects (sha1) as possible by analyzing .git/packed-refs, .git/index, etc.
* Download idx and pack files.
* Now you can run git checkout -- . to retrieve source code.

How to Use

* python3 git-dump.py https://website.com/.git/
* Create the output directory and dump all the .git files in it.
* After running above script type: cd output && git checkout -- .
* It will recover all source code.

TODO

* Search through git repository for secrets by digging deep into commit history and branches.

Credits Sean B. Palmer for his index file parser. (https://github.com/sbp/gin)
Download GitDump

Hacking on Medium
TryHackMe: Ignite — Writeup

https://cdn-images-1.medium.com/max/600/0*ZaGYW2XTbs87wVjj.png
Today, we will explain how to use a well known CVE to exploit a vulnerable CMS. The machine we use is called Ignite, and is available here.

Continue reading on Medium »

Hacking on Medium
Hacking Basics for EVERYONE (Even for “N00bs”)

https://cdn-images-1.medium.com/max/824/1*1xQIcXZHHUFPXCi2sCkjfA.png
Easy to understand (extremely) beginner friendly crash course on cybersec prerequisites by THM.

Continue reading on Medium »