Discovery
Flag hosts that serve a public .git directory
Sweep a host list for publicly accessible .git directories.
overview
What mass-gitfinder does
mass-gitfinder reads a host file via -i and checks each target for a publicly reachable .git directory, writing the short list of leak candidates.
Use it after subdomain discovery and an HTTP prober such as httpx so checks run only on live hosts. Raise -t when the list is large.
Trickest provides mass-gitfinder as a managed Discovery node. It flags exposure only; route hits to gittools-dumper or gitjacker to recover the repository.
use cases
Where mass-gitfinder fits
Audit a domain estate for exposed source
Feed a full list of company subdomains and flag every host that serves a reachable .git directory, catching leaks before an attacker dumps the repository.
Triage a discovered attack surface
Run mass-gitfinder after subdomain discovery and HTTP probing so the .git check fires only against hosts that are confirmed live.
Recurring exposure monitoring
Schedule the scan against a maintained host list so newly deployed servers that ship their version control folder get caught soon after they go live.
Bug bounty source recovery
Scan a target's published domains for accessible .git paths, then pull the leaked repository to read source, hardcoded credentials, and internal endpoints.
reference
mass-gitfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | -i | File of hosts to check for an exposed .git directory. |
| threads | STRING | -t | Number of concurrent threads for the sweep. |
Showing key inputs. mass-gitfinder exposes 2 inputs in total.
example
Run mass-gitfinder
# mass-gitfinder: sweep hosts.txt for exposed .git with 40 threadsmass-gitfinder -i hosts.txt -t 40https://example.com/.git/https://staging.example.com/.git/https://dev.example.com/.git/https://old.example.com/.git/https://cdn-origin.example.com/.git/https://intranet.example.com/.git/# 6 hosts with accessible .git from 180 probedguidance
Choosing mass-gitfinder
Use mass-gitfinder when you have a host list and need to know which targets leak a .git directory. It checks one high-value path at scale after discovery and probing. Prefer meg or ffuf for broad path discovery.
meg
Fetches many paths across many hosts. Broader coverage; not specialized for .git.
mass-linkfinder
Extracts endpoints from JS URLs across a list. Different leak surface than version control.
ffuf
General content and directory fuzzer. Use when you need many paths; mass-gitfinder targets one.
faq
mass-gitfinder questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run mass-gitfinder yourself
A host list is probed by httpx for live targets, then Mass-GitFinder checks each one for an exposed .git directory and writes the leak candidates as a queryable output.
Facts on this page come from the live Trickest tool library.