Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that match signatures for potentially sensitive files. The findings will be presented through a web interface for easy browsing and analysis.

gitrob [options] target [target2] ... [targetN]

-bind-address string
    Address to bind web server to (default "127.0.0.1")
-commit-depth int
    Number of repository commits to process (default 500)
-debug
    Print debugging information
-enterprise-upload-url string
    Upload URL for Github Enterprise (defaults to the URL set in -enterprise-url if any)
-enterprise-url string
    URL for Github Enterprise
-enterprise-user string
    Username for Github Enterprise (defaults to first target)
-github-access-token string
    GitHub access token to use for API requests
-include-forks
    Include forked repositories in scan
-load string
    Load session file
-no-expand-orgs
    Don't add members to targets when processing organizations
-no-server
    Disables web server
-port int
    Port to run web server on (default 9393)
-save string
    Save session to file
-silent
    Suppress all output except for errors
-threads int
    Number of concurrent threads (default number of logical CPUs)
-gather-all
    Specify whether to pull all repositories from the domain

By default, gitrob will store its state for an assessment in memory. This means that the results of an assessment is lost when Gitrob is closed. You can save the session to a file by using the -save option:

gitrob -save ~/gitrob-session.json acmecorp

Gitrob will save all the gathered information to the specified file path as a special JSON document. The file can be loaded again for browsing at another point in time, shared with other analysts or parsed for custom integrations with other tools and systems.

A session stored in a file can be loaded with the -load option:

gitrob -load ~/gitrob-session.json

Gitrob will start its web interface and serve the results for analysis.

To configure Gitrob for Github Enterprise, the following switches can be used:

• enterprise-url: Must be specified; this is the URL where the path /api/v3/ exists. This is usually the URL where the Github web interface can be found. Example: -enterprise-url=https://github.yourcompany.com
• enterprise-upload-url: Optional, defaults to enterprise-url; full path to the upload URL if different from the main Github Enterprise URL. Example: -enterprise-upload-url=https://github.yourcompany.com/api/v3/upload
• enterprise-user: Optional, defaults to the first target. Example: -enterprise-user=your.username

A precompiled version is available for each release, alternatively you can use the latest version of the source code from this repository in order to build your own binary.

Make sure you have a correctly configured Go >= 1.11 environment and that $GOPATH/bin is in your $PATH

$ go get github.com/pr4jwal/gitrob
or
$git clone https://github.com/pr4jwal/gitrob.git
$cd gitrob
$go build

This command will download gitrob, install its dependencies, compile it and move the gitrob executable to $GOPATH/bin.

Gitrob will need a Github access token in order to interact with the Github API. Create a personal access token and save it in an environment variable in your .bashrc or similar shell configuration file:

export GITROB_ACCESS_TOKEN=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef

Alternatively you can specify the access token with the -github-access-token option, but watch out for your command history!