loading
Loading content
loading
Discovery
Flag hosts that serve a publicly accessible .git directory.
overview
After live-host probing, wire a host file into this node to mark which targets expose /.git/. Hits become the shortlist for dump and extract.
Pass hosts through -i (one host or URL per line). Raise -t when the list is large so checks run concurrently. Outputs are a file and folder of exposed hosts.
The Finder only discovers. It does not download or rebuild. Send hits to gittools-dumper and gittools-extractor, or to gitjacker for one-pass recovery. snallygaster covers broader misconfig classes if .git is only one check among many.
use cases
Run the Finder over a file of hosts to flag every site serving a public .git directory, instead of testing URLs one at a time.
Use the flagged hosts to point gittools-dumper at the few sites that are exposed, rather than dumping blindly across the scope.
Set the thread count so a large host list is checked quickly without overrunning the resolver or the targets.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | -i | Input file of hosts to check for an exposed .git directory. |
| threads | STRING | -t | Number of concurrent threads for the sweep. |
Showing key inputs. gittools-finder exposes 2 inputs in total.
example
# gittools-finder: sweep hosts.txt for exposed .git with 20 threadsgitfinder.py -i hosts.txt -t 20https://example.com/.git/https://staging.example.com/.git/https://dev.example.com/.git/https://old.example.com/.git/https://cdn-origin.example.com/.git/https://intranet.example.com/.git/# 6 hosts with accessible .git from 120 probedguidance
Use gittools-finder to learn which hosts expose a .git directory before you recover anything. It only finds. Feed hits to gittools-dumper and gittools-extractor, or to gitjacker, for download and rebuild.
Next step after Finder hits. Downloads the .git directories the Finder flags.
Recovers a single exposed repo end to end. Point it at hosts from the Finder list.
Scans for many sensitive files and misconfigurations, including exposed .git, across hosts.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A host list feeds gittools-finder, which flags sites with an exposed .git and passes them to gittools-dumper so the recovered repos land as output.
Facts on this page come from the live Trickest tool library.