# Git daemon

> Anonymous Git serving

- **URL:** https://hackindex.io/services/git-daemon
- **Type:** Service
- **Default ports:** 9418
- **Tags:** git, version-control, anonymous-access, tcp, source-code
- **Published:** 2026-01-26
- **Updated:** 2026-07-13

Git daemon serves Git repositories over the native Git protocol for fast, unauthenticated read access. It listens on **TCP port 9418**. Nmap identifies the service as `git`.

The Git protocol is designed for anonymous, read-only repository distribution and has no built-in authentication or encryption. When a Git daemon is exposed, anyone can clone the repositories it serves. This commonly leaks source code, infrastructure-as-code configurations, internal documentation, and, most critically, secrets embedded in commit history such as API keys, database passwords, private keys, and tokens. Even if secrets have been removed from the current branch, they remain in the Git history unless explicitly purged.

Enumeration involves attempting to clone repositories by guessing names or listing them if directory listing is enabled. Once cloned, searching the full commit history with tools like `trufflehog`, `gitleaks`, or `git log -p` reveals secrets and sensitive changes across all branches and tags. Checking for `.git/config` files can expose internal URLs, CI/CD integrations, and additional repository locations.

## Phases

- [Enumeration](https://hackindex.io/services/git-daemon/enumeration.md): Detect Git daemon, list refs, and find exposed repos with credentials (2 guides)
- [Exploitation](https://hackindex.io/services/git-daemon/exploitation.md): Clone repos and mine Git history for secrets and credentials (2 guides)