loading
Loading content
loading
Discovery
Download exposed .git directories when listing is disabled.
overview
gittools-dumper is the Dumper half of GitTools. It pulls objects, refs, and the index from a .git directory left in a public web root. Pass a target URL that includes /.git/.
Listing can be off. The tool requests known git paths by name, so a 403 on directory indexes does not stop the download when those files remain world-readable.
Dumping alone is not readable source. Chain gittools-extractor next, or use gittools-dumper-extractor for both steps. Prefer gitjacker when you want download and rebuild in one pass.
use cases
Point the Dumper at a target's /.git/ path to pull down the git objects and refs even when the server hides the folder listing.
Run the Dumper first to fetch the raw internals, then hand the folder to gittools-extractor to rebuild a readable source tree.
Recover the repository so a downstream secret scanner can read its history for credentials the deployed app never meant to expose.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | · | target URL including the /.git/ folder |
Showing key inputs. gittools-dumper exposes 1 inputs in total.
example
# gittools-dumper: download an exposed .git tree into ./dumpgitdumper.sh https://example.com/.git/ ./dump[+] Downloading from https://example.com/.git/[+] Destination: ./dump[*] Fetching HEAD[*] Fetching refs/heads/main[*] Fetching objects/info/packs[*] Fetching objects/pack/pack-8f3a1c2e.idx[*] Fetching objects/pack/pack-8f3a1c2e.pack[*] Fetching index[+] Dump complete: 142 objects under ./dumpguidance
Use gittools-dumper to grab an exposed .git when you want the raw dump kept. Follow with gittools-extractor to rebuild source, or use gittools-dumper-extractor for both. Prefer gitjacker for single-pass partial recovery.
Dump and reconstruct in one node when you want the working tree directly.
Downloads and rebuilds in one pass with partial-recovery support.
Rebuilds source from the folder the Dumper wrote.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A /.git/ URL feeds gittools-dumper, which downloads the git data and passes it to gittools-extractor so the reconstructed source lands as output.
Facts on this page come from the live Trickest tool library.