Code Repositories
Sub-technique of T1213 Data from Information Repositories ↗
Pulling code, secrets and credentials from git repositories (exposed on the web or internal, such as Gitea).
How it shows up on Hack The Box
An accessible /.git/ is downloaded with git-dumper. Check every commit, not just the last one: deleted credentials are still in the history.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster 3 min read Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.
- Exposed .git directory: git-dumper and secrets in the history 3 min read How to spot an exposed .git folder on a website, rebuild the repository with git-dumper and find passwords and keys in the commit history.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Web enumeration › Common findings
Dump an exposed .git
git-dumper http://box.htb/.git/ repo
Review the history
cd repo && git log --oneline && git show HEAD~1
Search secrets in every commit
git log -p | grep -iE 'pass|secret|token|key'git-dumper › From .git to the secret
Search secrets across the whole history
git log -p --all | grep -iE 'pass|secret|token|key'
See what changed in the last commit
git show --stat HEAD && git diff HEAD~1No command matches.