DVCS Ripper is a security and forensics toolkit that reconstructs source code repositories accidentally exposed on web servers. It understands multiple version-control systems—Git, Mercurial, Bazaar, and Subversion—and crawls their metadata directories to rebuild full history where possible. The utilities handle partial or blocked directory listings by guessing object paths and assembling missing pieces from loose files. Investigators and red-teamers use it to demonstrate the risk of deploying .git/ or .svn/ alongside web content, recovering not just code but also secrets committed by mistake. Outputs are normalized into usable repos so diffing, blame, and log analysis work as if you had pulled from the canonical remote. While powerful, it’s intended for legitimate testing and incident response, reinforcing best practices like build-time artifact generation and strict web server access rules.
Features
- Supports ripping Git, SVN, Mercurial (hg), and Bazaar (bzr) repositories
- Works even when directory browsing is turned off on the server
- Simple usage: run from an empty directory to download cloned data
- Lightweight script with few dependencies
- Useful for forensic analysis or security auditing of exposed VCS endpoints
- GPL-2.0 licensed and easily automatable in shell scripts
Project Samples
