Scanning non-local repositories

[BarMol3]

Hey! I saw this tool at blackhat last week and I think its a fantastic tool to add to the arsenal, however I'm coming up short on the correct syntax for scanning repositories that aren't locally stored. I'm using this in Docker on Windows currently.

Can anyone post an example of a working command to scan a github.com or similar repository?

[bradlarsen]

@flophype Great question! Due to time constraints, the version that @AnthonyPraetorian demoed at Black Hat was an internal version rather than the open-source version.

The features for enumerating GitHub organizations and users and for scanning repos without first manually cloning them are not yet implemented in the open-source Nosey Parker. They will be added soon!

[BarMol3]

Well that explains that! Thought I was going mad...

I'll keenly keep an eye out for the open-source update, cheers Brad.

[bradlarsen]

@BarMol3 I just merged #25, which adds a new github repos list command that uses the REST API to enumerate repositories belonging to one or more users or organizations.

There is still not yet built-in support in Nosey Parker for scanning a Git repository given just its URL (#14), but the just-added repository enumeration capabilities get this most of the way there. I'm going to be adding support for that next. At that point, you will be able to simply scan --git-url URL and not have to explicitly clone.

Until that point, you could use the enumeration capabilities of Nosey Parker to list repositories belonging to a user or organization, git clone them with a shell loop, and then scan with Nosey Parker.

[bradlarsen]

@BarMol3 I just merged back PR #27, which adds 3 new types of input specifiers to the scan command:

• --git-url URL, which allows automatic scanning of Git history given just an HTTPS URL to the repo
• --github-user NAME, which allows bulk scanning of accessible repositories belonging to the given user
• --github-org NAME, which allows bulk scanning of accessible repositories belonging to the given organization

See noseyparker help scan for more details. Let me know if you run into trouble.