# Check Exposed .git Directory

> Detect exposed .git directories on web servers that may leak source code, credentials, and project history via misconfigured web root deployments.

- **URL:** https://hackindex.io/services/web/vulnerability-discovery/check-exposed-git-directory
- **Path:** HTTP/HTTPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md)
- **Published:** 2026-01-23
- **Updated:** 2026-04-24

An exposed `.git` directory means the web server is serving the repository metadata and potentially the full source code of the application. This enables recovery of hardcoded credentials, internal API endpoints, secret keys, database connection strings, and the complete application logic. A confirmed exposure moves directly to [git repository exploitation](https://hackindex.io/services/web/exploitation/git-repository-exploitation) to dump and extract the full source.

What an exposed git directory reveals:

- Full source code including server-side logic and authentication flows
- Hardcoded credentials, API keys, and database connection strings
- Commit history with previously deleted secrets and rotated passwords
- Remote repository URLs pointing to internal infrastructure
- Developer names and email addresses from commit metadata

## Confirm Exposed Git Directory

The fastest check is a direct request to `.git/HEAD`. The response must be the actual git ref content, not an HTML page or redirect:

```bash
curl -sk http://$TARGET_IP:$PORT/.git/HEAD
# ref: refs/heads/main
```

If you get HTML, a redirect, or a 403 with a branded error page, the directory is likely blocked or rewritten. A response of `ref: refs/heads/main` or `ref: refs/heads/master` is a confirmed positive.

Check additional git metadata files to confirm the scope of exposure:

```bash
curl -sk http://$TARGET_IP:$PORT/.git/config
# [core]
#     repositoryformatversion = 0
#     filemode = true
# [remote "origin"]
#     url = https://github.com/company/internal-app.git
```

```bash
curl -skI http://$TARGET_IP:$PORT/.git/index
# HTTP/1.1 200 OK
# Content-Length: 8432
```

```bash
curl -sk http://$TARGET_IP:$PORT/.git/packed-refs
```

A 200 on `.git/config` or `.git/index` alongside HEAD confirms the repository is exposed and downloadable. The remote URL in config often reveals the original repository location, which can expose additional intelligence about the codebase.

## Check for Directory Listing

If directory listing is enabled on `.git/`, the full structure is browsable and trivial to dump:

```bash
curl -sk http://$TARGET_IP:$PORT/.git/ | grep -i 'href\|Index of'
# Index of /.git
# <a href="HEAD">HEAD</a>
# <a href="config">config</a>
# <a href="objects/">objects/</a>
```

Directory listing visible on `.git/` means every object is individually downloadable. This is the worst-case exposure: the entire commit history including deleted files and rotated credentials is recoverable.

## Quick Secrets Scan on Accessible Files

Before running a full dump, pull a few key files to confirm whether credentials are immediately accessible:

```bash
curl -sk http://$TARGET_IP:$PORT/.git/COMMIT_EDITMSG
```

```bash
curl -sk http://$TARGET_IP:$PORT/.env
```

```bash
curl -sk http://$TARGET_IP:$PORT/.gitignore
# *.env
# config/database.yml
# secrets.json
```

The `.gitignore` file reveals which sensitive files were intentionally excluded from the repository. Those filenames are worth probing directly: they often still exist on the server even if they were never committed. Move to [git repository exploitation](https://hackindex.io/services/web/exploitation/git-repository-exploitation) to dump the full repository and extract source code, credentials, and commit history.

## References

- [git-dumper](https://github.com/arthaud/git-dumper) - Tool for dumping exposed .git repositories from web servers