Skip to content
HackIndex logo

HackIndex

Git Repository Enumeration

3 min read Apr 4, 2026

Once a repository is confirmed accessible via Git daemon, enumerate its structure before cloning the full history. Branch names reveal development workflow and environment names. Tag names reveal release cadence and versioning. Commit counts give a sense of history depth before committing to a full clone. Run this after Git daemon service detection confirms at least one accessible repository.

List Branches and Tags with git ls-remote

git ls-remote speaks the git protocol and retrieves the full ref list without cloning:

┌──(kali㉿kali)-[~]
└─$ git ls-remote git://$TARGET_IP/repo.git 
a1b2c3d4e5f6...  HEAD
a1b2c3d4e5f6...  refs/heads/main
b2c3d4e5f6a7...  refs/heads/develop
c3d4e5f6a7b8...  refs/heads/feature/payment-integration
d4e5f6a7b8c9...  refs/tags/v1.0
e5f6a7b8c9d0...  refs/tags/v2.3-prod

Branch names like feature/payment-integration reveal what the team is working on. Tags like v2.3-prod confirm which commit is in production — useful for targeting the exact code running on the server. The develop branch typically has more recent and potentially less-reviewed code than main.

Check Multiple Discovered Repositories

┌──(kali㉿kali)-[~]
└─$ for repo in repo.git config.git; do
echo "=== $repo ==="
git ls-remote git://$TARGET_IP/$repo 2>/dev/null | awk '{print $2}' | head -10
done 
=== repo.git ===
HEAD
refs/heads/main
refs/heads/develop
=== config.git ===
HEAD
refs/heads/main
refs/heads/staging
refs/heads/production

A config repo with staging and production branches strongly suggests environment-specific configuration files — database credentials, API keys, and infrastructure details separated by environment. This is the highest-priority target.

Shallow Clone for Quick Assessment

Before committing to a full clone of a large repository, do a shallow clone to assess the most recent commit only:

┌──(kali㉿kali)-[~]
└─$ git clone --depth 1 git://$TARGET_IP/repo.git /tmp/repo_shallow
┌──(kali㉿kali)-[~]
└─$ ls -la /tmp/repo_shallow/ 
total 48
-rw-r--r-- .env
-rw-r--r-- config.yml
-rw-r--r-- deploy.sh
drwxr-xr-x src/

A .env file in the repository root is an immediate critical finding — these files routinely contain database credentials, API keys, and service tokens. A shallow clone gets the latest commit only, which is fastest for initial triage. If the current files look clean, the history may still contain deleted secrets — move to full repository cloning to pull the complete history.

View Recent Commit Messages

Commit messages often reveal what changed and why — passwords being rotated, credentials being removed, or security fixes being applied:

┌──(kali㉿kali)-[~]
└─$ cd /tmp/repo_shallow && git log --oneline --all 2>/dev/null | head -20 
a1b2c3d (HEAD -> main) fix: remove hardcoded API key
b2c3d4e add production database config
c3d4e5f initial commit with credentials

A commit message saying "remove hardcoded API key" means the key existed in a previous commit. A shallow clone does not have that history — get the full history. Move to repository cloning and then history secret mining.

References