# Git Repository Enumeration

- **URL:** https://hackindex.io/services/git-daemon/enumeration/git-repository-enumeration
- **Path:** Git daemon > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/git-daemon/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

Once a repository is confirmed accessible via Git daemon, enumerate its structure before cloning the full history. Branch names reveal development workflow and environment names. Tag names reveal release cadence and versioning. Commit counts give a sense of history depth before committing to a full clone. Run this after [Git daemon service detection](https://hackindex.io/services/git-daemon/enumeration/git-daemon-service-detection) confirms at least one accessible repository.

- List Branches and Tags with git ls-remote
- Check Multiple Discovered Repositories
- Shallow Clone for Quick Assessment
- View Recent Commit Messages

## List Branches and Tags with git ls-remote

git ls-remote speaks the git protocol and retrieves the full ref list without cloning:

```bash
git ls-remote git://$TARGET_IP/repo.git
# a1b2c3d4e5f6...  HEAD
# a1b2c3d4e5f6...  refs/heads/main
# b2c3d4e5f6a7...  refs/heads/develop
# c3d4e5f6a7b8...  refs/heads/feature/payment-integration
# d4e5f6a7b8c9...  refs/tags/v1.0
# e5f6a7b8c9d0...  refs/tags/v2.3-prod
```

Branch names like `feature/payment-integration` reveal what the team is working on. Tags like `v2.3-prod` confirm which commit is in production: useful for targeting the exact code running on the server. The develop branch typically has more recent and potentially less-reviewed code than main.

## Check Multiple Discovered Repositories

```bash
for repo in repo.git config.git; do
  echo "=== $repo ==="
  git ls-remote git://$TARGET_IP/$repo 2>/dev/null | awk '{print $2}' | head -10
done
# === repo.git ===
# HEAD
# refs/heads/main
# refs/heads/develop
# === config.git ===
# HEAD
# refs/heads/main
# refs/heads/staging
# refs/heads/production
```

A config repo with `staging` and `production` branches strongly suggests environment-specific configuration files: database credentials, API keys, and infrastructure details separated by environment. This is the highest-priority target.

## Shallow Clone for Quick Assessment

Before committing to a full clone of a large repository, do a shallow clone to assess the most recent commit only:

```bash
git clone --depth 1 git://$TARGET_IP/repo.git /tmp/repo_shallow
ls -la /tmp/repo_shallow/
# total 48
# -rw-r--r-- .env
# -rw-r--r-- config.yml
# -rw-r--r-- deploy.sh
# drwxr-xr-x src/
```

A `.env` file in the repository root is an immediate critical finding: these files routinely contain database credentials, API keys, and service tokens. A shallow clone gets the latest commit only, which is fastest for initial triage. If the current files look clean, the history may still contain deleted secrets: move to [full repository cloning](https://hackindex.io/services/git-daemon/exploitation/git-repository-cloning) to pull the complete history.

## View Recent Commit Messages

Commit messages often reveal what changed and why: passwords being rotated, credentials being removed, or security fixes being applied:

```bash
cd /tmp/repo_shallow && git log --oneline --all 2>/dev/null | head -20
# a1b2c3d (HEAD -> main) fix: remove hardcoded API key
# b2c3d4e add production database config
# c3d4e5f initial commit with credentials
```

A commit message saying "remove hardcoded API key" means the key existed in a previous commit. A shallow clone does not have that history: get the full history. Move to [repository cloning](https://hackindex.io/services/git-daemon/exploitation/git-repository-cloning) and then [history secret mining](https://hackindex.io/services/git-daemon/exploitation/git-history-secret-mining).

## References

- [git-ls-remote](https://git-scm.com/docs/git-ls-remote) - List references in a remote repository without cloning