Skip to content

Parses unauthenticated Gitlab APIs for users, repos, groups and secrets.

License

Notifications You must be signed in to change notification settings

ldionmarcil/gitlab-unauth-parser

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

gitlab-unauth-parser

Parses interesting Gitlab v4 unauthenticated APIs to extract useful information such as:

  • Public Repositories
  • Users
  • Groups

Usage

$ poetry run python -m gitlab_unauth_parser -h
usage: gitlab_unauth_parser.py [-h] [-u URL] [-f] [-c CLONE] [-w WRITE]

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     URL containing the Gitlab instance
  -f, --fingerprint     Don't try to detect valid Gitlab instance
  -c CLONE, --clone CLONE
                        Repository to clone projects to. Will not clone if unspecified
  -w WRITE, --write WRITE
                        Write output to file (repos.txt, groups.txt, users.txt)

Example: $ poetry run python -m gitlab_unauth_parser -u https://gitlab.gnome.org/ -c /tmp/foobar

Purpose

Repositories

Unbeknownst to many Gitlab administrators, "public" repositories do not mean "public to the organization". They mean public to all, even if the Gitlab instance has no public registration. Using the Gitlab API, it is possible to find these repositories and then clone them.

Users

The Gitlab user API starts at user ID 1 and is incremented by 1 for each user. With this knowledge, this script starts at the begining and requests user IDs until 20 subsequent user IDs are not found, indicating that the last user has likely been found. Using this, we can extract the list of users of some Gitlab instances without authentication.

Groups

Groups can help understand the kind of data this Gitlab instance is responsible for hosting.

For more information on the visibility of users, consult the Gitlab documentation: https://gitlab.com/gitlab-org/gitlab-foss/-/blob/master/doc/public_access/public_access.md#visibility-of-users

Installation

git clone https://github.com/ldionmarcil/gitlab-unauth-parser/
cd gitlab-unauth-parser
poetry install

Once done, you can run $ poetry run python -m gitlab_unauth_parser -h

About

Parses unauthenticated Gitlab APIs for users, repos, groups and secrets.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages