Misconfiguration
Rebuild a working tree from a public .git leak
gitjacker is a source-recovery tool that downloads git repositories exposed by sites where the .git directory was mistakenly uploaded and extracts their contents, retrieving a significant portion of the source even when directory listing is disabled.
installcurl -s https://raw.githubusercontent.com/liamg/gitjacker/master/scripts/install.sh | bash
Go · Unlicense license
overview
What gitjacker does
gitjacker downloads git objects from a site that shipped /.git/ in the web root, then rebuilds a working copy. Pass the target URL; turn on --verbose when you need per-step retrieval logs.
Partial recovery is the point. When directory listing returns 403, it still walks objects by hash and often recovers most of the tree, including config and committed credentials the app never meant to publish.
Run it after a finder flags a reachable .git. Prefer gitjacker for one-pass rebuild; use gittools-dumper plus extractor when you want the raw dump kept separate. Feed the folder into gitleaks next.
source github.com/liamg/gitjacker
use cases
Where gitjacker fits
Reconstruct source from an exposed .git
Point gitjacker at a URL whose .git directory is reachable and it rebuilds the repository, recovering code and config the site never meant to publish.
Recover repos with directory listing disabled
gitjacker walks git objects by hash, so it still pulls back a large share of the repository even when the server hides the folder contents.
Scan the recovered code for committed secrets
Hand the reconstructed repository to a tool like gitleaks so committed keys, tokens, and passwords in the git history surface as triaged findings.
Triage a .git exposure during a pentest
Confirm the impact of an exposed .git finding by recovering the real source, then report exactly which files, credentials, and internal logic were reachable.
reference
gitjacker inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | · | Target URL of the site with an exposed .git directory. |
| verbose | BOOLEAN | --verbose | Enable verbose logging of each retrieval and recovery step. |
Showing key inputs. gitjacker exposes 2 inputs in total.
example
Run gitjacker
# download and rebuild the repo from an exposed .git directory
gitjacker --verbose https://example.com/gitjacker v0.1.0
Retrieving .git/config from https://example.com/ ...
Walking loose and packed objects by hash...
Summary
=======
Status: partial success
Objects retrieved: 318 (repo ~89% recovered)
Remote origin: git@github.com:example/webapp.git
Secrets found: .env, config/database.yml
Output written to: ./example.comguidance
Choosing gitjacker
Use gitjacker when a host serves /.git/ and you need the source back in one step. Prefer the GitTools dumper/extractor chain when you want the raw dump preserved; always follow recovery with a secret scan.
gittools-dumper
Downloads the exposed .git only; pair with gittools-extractor to rebuild the tree.
gittools-dumper-extractor
GitTools dump and extract in one node; closest one-shot peer.
gitleaks
Secret scanner for the recovered repo; not a downloader.
faq
gitjacker questions
Run gitjacker yourself
A target URL feeds gitjacker, which reconstructs the exposed repository and hands it to gitleaks so any committed secrets land as output.
Facts on this page come from the live Trickest tool library.