Skip to content

This tool analyzes a given Gitlab repository and searches for dangling or force-pushed commits containing potential secret or interesting information.

Notifications You must be signed in to change notification settings

RichardoC/gitlab-secrets

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 

Repository files navigation

Gitlab Secrets

This tool analyzes a given Gitlab repository and searches for dangling or force-pushed commits, containing potential secret or interesting information.

It's based on https://github.com/neodyme-labs/github-secrets which does the same for Github

Requirements

Installation

git clone https://github.com/neodyme-labs/github-secrets.git

Usage

To get a list of basic options and switches use:

python3 gitlab_scanner.py -h

You can run this script either completely unauthenticated if you are checking public repositories, or your generated API token by following this guide.

The tokens need requires read_api scope.

To export the token use:

export GITLAB_ACCOUNT_TOKEN=<your_secret_api_token>

To use against a custom instance of Gitlab

export GITLAB_INSTANCE_URL=<your_instance_url>

To run the script and scan a repository:

python3 gitlab_scanner.py <organisation>/<repository>

An example repository for testing is https://gitlab.com/gitlab-secrets/gitlab-secrets

Limitations

This can only detect dangling commits from the last 3 years due to the retention period on events in Gitlab.

License

Licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

About

This tool analyzes a given Gitlab repository and searches for dangling or force-pushed commits containing potential secret or interesting information.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages