Git daemon

Git daemon serves Git repositories over the native Git protocol for fast, unauthenticated read access. It listens on TCP port 9418. Nmap identifies the service as git.

The Git protocol is designed for anonymous, read-only repository distribution and has no built-in authentication or encryption. When a Git daemon is exposed, anyone can clone the repositories it serves. This commonly leaks source code, infrastructure-as-code configurations, internal documentation, and, most critically, secrets embedded in commit history such as API keys, database passwords, private keys, and tokens. Even if secrets have been removed from the current branch, they remain in the Git history unless explicitly purged.

Enumeration involves attempting to clone repositories by guessing names or listing them if directory listing is enabled. Once cloned, searching the full commit history with tools like trufflehog, gitleaks, or git log -p reveals secrets and sensitive changes across all branches and tags. Checking for .git/config files can expose internal URLs, CI/CD integrations, and additional repository locations.