git-dumper
Use git-dumper when a web server exposes repository metadata under /.git/. It reconstructs what it can retrieve, making source and history available for inspection. Keep recovered repositories in an isolated review environment: upstream warns that attacker-controlled repository content can lead to execution on the machine performing the download.
1. Confirm a real Git response
curl -i 'http://app.domain.htb/.git/HEAD'
curl -i 'http://app.domain.htb/.git/config'A plausible HEAD contains a branch reference or commit identifier. Compare it with a nonexistent URL: a generic HTML page returning 200 is not evidence that Git metadata is exposed.
2. Recover into a new directory
git-dumper --help
git-dumper -j 2 -t 10 'http://app.domain.htb/.git/' recovered-appThe URL is the exposed metadata location; the directory is local output. Start with modest concurrency, capture warnings, and keep the download separate from repositories you already use.
3. Verify the reconstruction
git -C recovered-app rev-parse --is-inside-work-tree
git -C recovered-app --no-pager log --oneline --all -n 20
git -C recovered-app fsck --fullDangling objects are not the same as missing or corrupt objects. An incomplete download can still yield useful files, but state that limitation. Do not run recovered application code, build scripts or dependency installation just to inspect it.
4. Inspect source and history
# Identify files to review without printing secret values immediately
rg -l -i 'password|passwd|api[_-]?key|connectionstring|secret' \
recovered-app --glob '!.git/**'
# Search commit history for the addition/removal of a relevant field
git -C recovered-app --no-pager log --all -S 'DB_PASSWORD' --oneline
# Inspect a selected historical version; substitute an observed commit/path
git -C recovered-app --no-pager show '<commit>:<config-path>'A deleted secret may remain in a historical object. Record the commit/path and distinguish a candidate credential from one validated on a specific service. Removing it from the latest commit does not revoke it.
Success and next step
Success: genuine metadata is retrievable and meaningful source or history is recovered. A download directory existing does not establish completeness. For evidence, retain the response, relevant file/commit and a redacted impact demonstration.
The corrective action is to stop serving repository metadata and rotate exposed credentials; removing directory listing alone does not block direct object retrieval. See Git for repository inspection and John extractors if the recovered artifact is encrypted.