GitGhost is an OSINT tool that scans public GitHub repositories for exposed secrets and information that may still exist in a repository’s Git history. It generates an exposure report for a GitHub user or organization, it is useful for learning GitHub OSINT and repository security through publicly available data.
Features of the GitGhost Tool:
- Scan GitHub users and organizations.
- Analyze public repositories.
- Search Git history for exposed secrets.
- Generate an HTML exposure report.
- Calculate an exposure score.
- Perform GitHub OSINT.
Installation Commands
Copy and run the following commands in Termux to install GitGhost
Install Git and Python.
pkg install git python -y
Clone the GitGhost repository.
git clone https://github.com/cy3erm/gitghost
Move into the project directory.
cd gitghost
Run GitGhost.
python3 -m gitghost <username>
GitGhost is now installed and ready to use.
Usage Commands
After installing GitGhost, you can scan GitHub users, organizations, or repositories using the commands below.
Display the help menu.
python3 -m gitghost -h
Scan a GitHub user or organization.
python3 -m gitghost username123
Show the installed version.
python3 -m gitghost --version
Scan a single repository.
python3 -m gitghost --repo owner/repository
Scan a local repository.
python3 -m gitghost --local /path/to/repository
Limit the number of repositories to scan.
python3 -m gitghost --limit 10 username
Save the report to a custom HTML file.
python3 -m gitghost --out report.html username
Replace username, owner/repository, or /path/to/repository with your target. GitGhost will analyze the available public repositories, scan the Git history, and generate an HTML exposure report.
Overview
GitGhost is a useful OSINT tool for analyzing public GitHub repositories and learning about repository exposure. It is simple to install, easy to use, and helps to understand GitHub security through publicly available information.
