loading
Loading content
loading
Discovery
Download .git repositories from web servers without directory listing.
overview
gittools-dumper is the Dumper component of the GitTools project. It downloads a .git directory that a site accidentally deployed to its web root, pulling objects, refs, and the index over HTTP. It works when directory listing is disabled, because it requests known git paths by name rather than browsing the folder.
Dumping is only the first half of recovering a leaked repository. The Dumper retrieves the raw git internals; turning those into readable source needs the Extractor, which reconstructs the working tree from the objects. Running the two in sequence is the standard GitTools recovery flow.
On Trickest, gittools-dumper is a Discovery node that takes a target URL ending in /.git/ and writes a folder of the downloaded git data. Chain it before gittools-extractor to reconstruct the code, then route the result into a secret scanner to triage what leaked.
use cases
Point the Dumper at a target's /.git/ path to pull down the git objects and refs even when the server hides the folder listing.
Run the Dumper first to fetch the raw internals, then hand the folder to gittools-extractor to rebuild a readable source tree.
Recover the repository so a downstream secret scanner can read its history for credentials the deployed app never meant to expose.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | · | target URL including the /.git/ folder |
Showing key inputs. gittools-dumper exposes 1 inputs in total.
example
# gittools-dumper: download an exposed .git tree into ./dumpgitdumper.sh https://example.com/.git/ ./dump[+] Downloading from https://example.com/.git/[+] Destination: ./dump[*] Fetching HEAD[*] Fetching refs/heads/main[*] Fetching objects/info/packs[*] Fetching objects/pack/pack-8f3a1c2e.idx[*] Fetching objects/pack/pack-8f3a1c2e.pack[*] Fetching index[+] Dump complete: 142 objects under ./dumpguidance
Use gittools-dumper to grab an exposed .git directory when listing is disabled. It only downloads, so follow it with gittools-extractor to rebuild the source, or use gittools-dumper-extractor to do both in one node.
Combines dumping and recovery in one step; use it when you want the reconstructed tree directly.
Downloads and reconstructs an exposed repo in a single pass with partial-recovery support.
The recovery half of GitTools; reconstructs source from what the Dumper pulled down.
faq
related
Check whether a URL redirects to a masked 404 page.
Append lines to a file only if they are not already there.
Extract URLs and endpoints from Android APK files.
Visual inspection of websites across a large number of hosts.
Find suspicious files across a large set of AWS S3 buckets.
An automated tool that checks for backup artifacts that may disclose a web application's source code.
A /.git/ URL feeds gittools-dumper, which downloads the git data and passes it to gittools-extractor so the reconstructed source lands as output.
Facts on this page come from the live Trickest tool library.