Enumerate git repository URL from list of URL / User / Org. Friendly to pipeline

This tool is available when the repository, such as github, is included in the bugbounty scope. Sometimes specified as an org name or user name rather than a specific repository, you can use this tool to extract url from all public repositories included in the org/user.

This can be used for various actions such as scanning or cloning for multiple repositories.



NOTICE
For unauthenticated requests in github api, the rate limit allows for up to 60 requests per hour. Unauthenticated requests are associated with the originating IP address, and not the user making requests. https://docs.github.com/en/rest/overview/resources-in-the-rest-api

So too many tasks can be blocked by the API for a certain time from github. In this case, you can select the appropriate destination or access and use any IP using the torsocks(e.g torsocks gitls -l user.list) or -tor options.

Installation

From go-get

▶ GO111MODULE=on go get -v github.com/hahwul/gitls

Using homebres

▶ brew tap hahwul/gitls▶ brew install gitls

Using snapcraft

▶ sudo snap install gitls

Usage

Usage of gitls:  -include-users    	include repo of org users(member)  -l string    	List of targets (e.g -l sample.lst)  -o string    	write output file (optional)  -proxy string    	using custom proxy  -tor    	using tor proxy / localhost:9050  -version    	version of gitls

Case Study

Make all repo urls from repo/org/user urls

sample.lst

https://github.com/hahwulhttps://github.com/tomnomnom/gronhttps://github.com/tomnomnom/httprobehttps://github.com/s0md3v

make repo url list from sample file

▶ gitls -l sample.lsthttps://github.com/hahwul/a2svhttps://github.com/hahwul/action-dalfoxhttps://github.com/hahwul/asset-of-hahwul.comhttps://github.com/hahwul/awesome-zap-extensionshttps://github.com/hahwul/backbombhttps://github.com/hahwul/booungJShttps://github.com/hahwul/buildpack-nmaphttps://github.com/hahwul/buildpack-zap-daemonhttps://github.com/hahwul/can-i-protect-xsshttps://github.com/hahwul/cyan-snakehttps://github.com/hahwul/dalfoxhttps://github.com/hahwul/DevSecOpshttps://github.com/hahwul/droid-hunterhttps://github.com/hahwul/exploit-db_to_dokuwikihttps://github.com/hahwul/ftchttps://github.com/hahwul/gitlshttps://github.com/hahwul/go-github-selfupdate-patchedhttps://github.com/hahwul/hack-pet...snip...https://github.com/hahwul/zap-cloud-scanhttps://github.com/tomnomnom/gronhttps://github.com/tomnomnom/httprobehttps://github.com/s0md3v/Arj   unhttps://github.com/s0md3v/AwesomeXSShttps://github.com/s0md3v/Blazyhttps://github.com/s0md3v/Bolt...snip...https://github.com/s0md3v/velocityhttps://github.com/s0md3v/XSStrikehttps://github.com/s0md3v/Zenhttps://github.com/s0md3v/zetanize

Get all repository in org and included users(members)

▶ echo https://github.com/paypal | ./gitls -include-users

....https://github.com/paypal/tech-talkshttps://github.com/paypal/TLS-updatehttps://github.com/paypal/yuritahttps://github.com/ahunnargikarhttps://github.com/ahunnargikar/docker-chronos-imagehttps://github.com/ahunnargikar/docker-tomcat7https://github.com/ahunnargikar/DockerConDemohttps://github.com/ahunnargikar/elasticsearch-registry-backendhttps://github.com/ahunnargikar/elasticsearchindexhttps://github.com/ahunnargikar/jenkins-dindhttps://github.com/ahunnargikar/jenkins-standalonehttps://github.com/ahunnargikar/vagrant-mesoshttps://github.com/ahunnargikar/vagrant_docker_registryhttps://github.com/anandpalanisamyhttps://github.com/anilgurselhttps://github.com/anilgursel/squbs-samplehttps://github.com/bluepnume

Automated testing with gitleaks

▶ gitls -l sample.lst | xargs -I % gitleaks --repo-url=% -v

All clone target's repo

▶ echo "https://github.com/paypal" | gitls | xargs -I % git clone %