Updated Jul 15, 2026

Discovery

Sweep a host list for public .git paths

Flag hosts that serve a publicly accessible .git directory.

Agent

overview

What gittools-finder does

After live-host probing, wire a host file into this node to mark which targets expose /.git/. Hits become the shortlist for dump and extract.

Pass hosts through -i (one host or URL per line). Raise -t when the list is large so checks run concurrently. Outputs are a file and folder of exposed hosts.

The Finder only discovers. It does not download or rebuild. Send hits to gittools-dumper and gittools-extractor, or to gitjacker for one-pass recovery. snallygaster covers broader misconfig classes if .git is only one check among many.

source github.com/internetwache/GitTools

use cases

Where gittools-finder fits

Sweep a host list for exposed .git

Run the Finder over a file of hosts to flag every site serving a public .git directory, instead of testing URLs one at a time.

Target recovery only where it pays off

Use the flagged hosts to point gittools-dumper at the few sites that are exposed, rather than dumping blindly across the scope.

Tune concurrency for wide scopes

Set the thread count so a large host list is checked quickly without overrunning the resolver or the targets.

reference

gittools-finder inputs and flags

2 inputs
NameTypeFlagDescription
input-fileFILE-iInput file of hosts to check for an exposed .git directory.
threadsSTRING-tNumber of concurrent threads for the sweep.

Showing key inputs. gittools-finder exposes 2 inputs in total.

example

Run gittools-finder

gittools-finder · command
# gittools-finder: sweep hosts.txt for exposed .git with 20 threadsgitfinder.py -i hosts.txt -t 20
sample output
https://example.com/.git/https://staging.example.com/.git/https://dev.example.com/.git/https://old.example.com/.git/https://cdn-origin.example.com/.git/https://intranet.example.com/.git/# 6 hosts with accessible .git from 120 probed

guidance

Choosing gittools-finder

Use gittools-finder to learn which hosts expose a .git directory before you recover anything. It only finds. Feed hits to gittools-dumper and gittools-extractor, or to gitjacker, for download and rebuild.

gittools-dumper

Next step after Finder hits. Downloads the .git directories the Finder flags.

gitjacker

Recovers a single exposed repo end to end. Point it at hosts from the Finder list.

snallygaster

Scans for many sensitive files and misconfigurations, including exposed .git, across hosts.

faq

gittools-finder questions

For each host in the input file, it tests whether a .git directory is publicly accessible, then reports the hosts that are exposed.

Run gittools-finder yourself

A host list feeds gittools-finder, which flags sites with an exposed .git and passes them to gittools-dumper so the recovered repos land as output.

Facts on this page come from the live Trickest tool library.