git-dumper

Downloads an HTTP-exposed .git and rebuilds the repository to read its history.

Downloads a Git repository exposed on a web server (a .git folder reachable over HTTP) and rebuilds the full working tree. From there you read the history with git log -p, which often contains credentials, keys and source code that reveal the application logic or the next step. It is the tool you reach for when fuzzing uncovers /.git/.

Family Web discovery & fuzzing

Flags http://<ip>/.git/ ./loot

Concepts Exposed .git directory, Secrets in git history, Credentials in source code

Cheatsheet Common apps (Tomcat, Jenkins, Git...)

Installation

pipx install git-dumper

Repositorygithub.com/arthaud/git-dumper

Useful commands3 commands

Appears in

Some machines where its use is documented; not an exhaustive list.

TricksterHackTheBox