Skip to content
HackIndex logo

HackIndex

Git Daemon Service Detection

2 min read Apr 4, 2026

Git daemon serves repositories over the git:// protocol on port 9418. It is typically deployed for fast, unauthenticated read-only access to public repositories, but is frequently misconfigured to expose internal repositories that should not be publicly accessible. The service itself provides no authentication — any repository marked with a git-daemon-export-ok file is accessible to any connecting client. Detection is straightforward; the interesting work is in what the repositories contain.

Port Detection

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 9418 $TARGET_IP 
9418/tcp open  git     Git

Protocol Probe — Confirm Response

The git protocol uses a pkt-line format. Send a minimal upload-pack request to confirm the daemon is responding and read the initial ref advertisement:

┌──(kali㉿kali)-[~]
└─$ # Send a git-upload-pack request for a likely repo name and read the response
┌──(kali㉿kali)-[~]
└─$ printf '0039git-upload-pack /repo.git\0host=%s\0' $TARGET_IP | nc -w5 $TARGET_IP 9418 | strings | head -20 
HEAD
refs/heads/main
refs/heads/develop
refs/tags/v1.0
refs/tags/v2.3

Ref names in the response confirm the repository exists and is accessible. Branch names and tags are immediately visible — develop and feature branches often contain work-in-progress code with more secrets than the main branch.

nmap Script Enumeration

┌──(kali㉿kali)-[~]
└─$ nmap -p 9418 $TARGET_IP --script git-info

Probe Common Repository Names

Git daemon does not list available repositories — you need to guess names. Test common repository names and check which ones respond with ref data:

┌──(kali㉿kali)-[~]
└─$ for repo in repo webapp app website api backend frontend config infrastructure secrets; do
result=$(printf '003bgit-upload-pack /%s.git\0host=%s\0' $repo $TARGET_IP | nc -w2 $TARGET_IP 9418 2>/dev/null | strings | grep -c 'refs/')
[ $result -gt 0 ] && echo "FOUND: git://$TARGET_IP/$repo.git"
done 
FOUND: git://10.10.10.50/repo.git
FOUND: git://10.10.10.50/config.git

A config repository is an immediate high-value target — it likely contains deployment configurations, credentials, and infrastructure details. Move to repository enumeration to explore the found repos before cloning.

References