Insecure Source Code Management · passage 10 of 24

Git: diggit.py

1 code block · Insecure Source Code Management/Git.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

* [bl4de/security-tools/diggit](https://github.com/bl4de/security-tools/)

./diggit.py -u remote_git_repo -t temp_folder -o object_hash [-r=True]
./diggit.py -u http://web.site -t /path/to/temp/folder/ -o d60fbeed6db32865a1f01bb9e485755f085f51c1

`-u` is remote path, where .git folder exists `-t` is path to local folder with dummy Git repository and where blob content (files) are saved with their real names (`cd /path/to/temp/folder && git init`) `-o` is a hash of particular Git object to download

Every one of the 24 is a mark on the map. Named now: 1 to 24, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.