git-dumper
If /.git/HEAD responds, the server is serving the repository. git-dumper rebuilds it even when directory listing is off; then check every commit, because deleted credentials are still in the history.
- Platform
- Linux · Windows · macOS (Python)
- Official site
- github.com/arthaud/git-dumper
- On HTB
- 7 machines
Install
pipx install git-dumpergit-dumper cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
From .git to the secret
Is it exposed?
curl -s http://box.htb/.git/HEAD
Restore deleted files in the working tree
cd repo && git checkout -- .
Search secrets across the whole history
git log -p --all | grep -iE 'pass|secret|token|key'
See what changed in the last commit
git show --stat HEAD && git diff HEAD~1In our cheatsheets
Web enumeration › Common findings
Dump an exposed .git
git-dumper http://box.htb/.git/ repoNo command matches.
HTB machines where git-dumper is used
Taken from the chapters of IppSec videos where git-dumper shows up. The ▶ link jumps to the minute of that part.
Guides that use git-dumper
- Exposed .git directory: git-dumper and secrets in the history 3 min read How to spot an exposed .git folder on a website, rebuild the repository with git-dumper and find passwords and keys in the commit history.
- Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster 3 min read Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.