Discovery
Fetch a leaked .git directory over HTTP
Download exposed .git directories when listing is disabled.
Shell · MIT license
overview
What gittools-dumper does
gittools-dumper is the Dumper half of GitTools. It pulls objects, refs, and the index from a .git directory left in a public web root. Pass a target URL that includes /.git/.
Listing can be off. The tool requests known git paths by name, so a 403 on directory indexes does not stop the download when those files remain world-readable.
Dumping alone is not readable source. Chain gittools-extractor next, or use gittools-dumper-extractor for both steps. Prefer gitjacker when you want download and rebuild in one pass.
use cases
Where gittools-dumper fits
Download a leaked .git directory
Point the Dumper at a target's /.git/ path to pull down the git objects and refs even when the server hides the folder listing.
Stage a repository for reconstruction
Run the Dumper first to fetch the raw internals, then hand the folder to gittools-extractor to rebuild a readable source tree.
Open a path to committed secrets
Recover the repository so a downstream secret scanner can read its history for credentials the deployed app never meant to expose.
reference
gittools-dumper inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | · | target URL including the /.git/ folder |
Showing key inputs. gittools-dumper exposes 1 inputs in total.
example
Run gittools-dumper
# gittools-dumper: download an exposed .git tree into ./dump
gitdumper.sh https://example.com/.git/ ./dump[+] Downloading from https://example.com/.git/
[+] Destination: ./dump
[*] Fetching HEAD
[*] Fetching refs/heads/main
[*] Fetching objects/info/packs
[*] Fetching objects/pack/pack-8f3a1c2e.idx
[*] Fetching objects/pack/pack-8f3a1c2e.pack
[*] Fetching index
[+] Dump complete: 142 objects under ./dumpguidance
Choosing gittools-dumper
Use gittools-dumper to grab an exposed .git when you want the raw dump kept. Follow with gittools-extractor to rebuild source, or use gittools-dumper-extractor for both. Prefer gitjacker for single-pass partial recovery.
gittools-dumper-extractor
Dump and reconstruct in one node when you want the working tree directly.
gitjacker
Downloads and rebuilds in one pass with partial-recovery support.
gittools-extractor
Rebuilds source from the folder the Dumper wrote.
faq
gittools-dumper questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run gittools-dumper yourself
A /.git/ URL feeds gittools-dumper, which downloads the git data and passes it to gittools-extractor so the reconstructed source lands as output.
Facts on this page come from the live Trickest tool library.