# WangYihang/GitHacker

🕷️ A `.git` folder exploiting tool that is able to restore the entire Git repository, including stash, common branches and common tags.

Repository: https://github.com/WangYihang/GitHacker
Canonical: https://ross.abutalabs.com/products/githacker
Homepage: https://githacker.pages.dev/
Language: Python
License Family: other
Topics: git, web-security, githack
Last push: 2026-08-23T06:35:29+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 35, longevity 100
- inputs: {"age_days": 3435, "days_push": 10, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1664, forks 248 (observed 2026-08-28T04:05:18.935550+00:00)

## What it is
GitHacker is a multi-threaded Python CLI tool that exploits exposed `.git` directories on web servers to reconstruct the entire Git repository, including branches, tags, stashes, and commit history, even without directory listings. It also ships a research site with a reproducible benchmark and security suite comparing it against other .git pillagers.

## Use cases
- dump a leaked .git folder from a website during a pentest
- recover source code and commit history from an exposed .git directory
- restore branches, tags, and stashes when directory listing is disabled
- brute-force git ref names on a target web server
- scan multiple URLs for exposed .git folders
- test .git pillager tools against malicious git directories

## When to choose
- you need the most complete recovery of a leaked repository including stashes and tags
- directory listing is disabled and you need ref brute-forcing
- you want a maintained tool hardened against malicious .git attacks
- you need to run the dump in a disposable Docker container

## When to avoid
- you only need a quick single-file download rather than a full repo reconstruction
- you are not authorized to test the target — this is an offensive security tool
- you need a GUI or non-command-line workflow

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, http-client, cli, web-scraping
- domain: security, penetration-testing, developer-tools
- platform: cli, python, windows
- tags: git-leakage, git-folder-exploitation, offensive-security, source-code-disclosure, pentest-tools, command-line, docker, linux, macos

## Member repositories
- WangYihang/GitHacker (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:18.935550+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:44:28.316577+00:00, confidence not recorded.
  - readme: https://github.com/WangYihang/GitHacker (fetched 2026-08-28T04:05:18.935550+00:00, sha 724156502279)
  - homepage: https://githacker.pages.dev/ (fetched 2026-08-29T11:16:37.393512+00:00, sha 92465e7c4454)
- Data as of 2026-08-30T08:39:29.467469+00:00.