GitGhost is a Python tool for checking public GitHub repositories and gists for accidentally exposed secrets. It can scan a GitHub user, organization, single repository, or a local Git checkout. It can also create an HTML report with the scan results.It is useful for security auditing and finding sensitive information that should not be publicly available.
Features of GitGhost tool:
- Scan a GitHub user’s public repositories.
- Scan public GitHub gists.
- Scan an organization’s public repositories.
- Scan a local Git repository.
- Check Git history for exposed information.
- Scan public repositories of organization members.
- Scan followers and following accounts.
- Run multiple scans in parallel.
- Generate an HTML report.
Commands to Install GitGhost
You can install GitGhost with a few simple commands. First, install the required packages and then download GitGhost to your device.
Update system packages.
apt update && apt upgrade -y
Install Python and Git (If not installed).
apt install python git -y
Clone the GitGhost repository.
git clone https://github.com/cy3erm/gitghost
Go to the GitGhost directory.
cd gitghost
Install the required Python packages.
pip install -r requirements.txt
GitGhost is now ready to use.
GitGhost Usage Commands
After installing GitGhost, you can start scanning GitHub users, organizations, repositories, or local repositories. Use the following commands to run different scan options.
Run GitGhost without any arguments.
python3 -m gitghost
The tool will display an interactive menu:
1) Scan a GitHub user public repos + gists
2) Scan an organization public repos of an org
3) Scan a single repo by owner/name or URL
4) Scan a local checkout a repo already on disk
select a mode [1-4], q to quit >
Choose any option from the menu and follow the instructions shown by the tool.
Scan a GitHub User
You can scan a user’s public repositories and gists using:
python3 -m gitghost username
For example:
python3 -m gitghost octocat
Scan a Single Repository
You can scan a specific repository using its owner and repository name:
python3 -m gitghost --repo owner/repository
You can also provide a repository URL:
python3 -m gitghost --repo https://github.com/owner/repository
Scan an Organization
Scan an organization’s public repositories:
python3 -m gitghost --org organization
You can also scan the organization’s public members:
python3 -m gitghost --org organization --members
Scan a Local Repository
If you already have a Git repository on your device, you can scan it directly:
python3 -m gitghost --local ./repository
You can give the local scan a custom name:
python3 -m gitghost --local ./repository --name my-project
Scan Public Gists
GitGhost scans public gists by default when scanning a GitHub user.
To skip gist scanning:
python3 -m gitghost username --no-gists
To enable gist scanning:
python3 -m gitghost username --gists
Scan Followers and Following
You can also scan the public repositories of a user’s followers and following accounts:
python3 -m gitghost username --network
You can set the maximum number of repositories to scan per identity:
python3 -m gitghost username --limit 50
GitGhost can clone and scan multiple repositories in parallel. You can change the number of jobs with:
python3 -m gitghost username --jobs 8
Save the HTML Report
The default report is saved as:
gitghost-dossier.html
You can choose a different output file:
python3 -m gitghost username --out report.html
Display all available options:
python3 -m gitghost -h
GitGhost provides different options to scan public GitHub repositories and find exposed information. These commands let you use the main features and choose the scan option you need.
Overview
GitGhost is a simple tool for checking GitHub repositories and finding exposed secrets in public code and Git history. It is a useful tool for developers and security researchers working with Git repositories.
