Exposed .git directory dumper
Reconstruct a repository from an exposed .git directory - recovering source, deleted files, and secrets from the commit history.
Open in ctfpalDeploying by git clone and forgetting to block .git/ leaves the entire repository readable over HTTP. That is not just the current source - it is every version of every file, including the commit where someone added a password and the commit where they removed it.
Reconstructing it
- `.git/HEAD` - confirms the directory is exposed and names the current branch. This is the one-request test.
- `.git/config` - remote URLs, sometimes with credentials embedded.
- `.git/index` - lists every tracked file, so you know what to fetch rather than guessing.
- `.git/objects/xx/yyyy...` - the content itself, zlib-compressed and addressed by SHA-1.
- `.git/logs/HEAD` - the reflog, which reaches commits no branch points at any more.
The same reasoning applies to .svn/, .hg/, and to .DS_Store, which lists directory contents and is often the fastest way to learn filenames that no wordlist would guess.
Part of a module
6. Web attacks and session tokens
Read and forge JWTs and Flask sessions, find content nobody linked to, and probe for injection with detection payloads.
Practise on real challenges
Related tools
Directory and path scanner
Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.
HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
Reverse shell generator
Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.