> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/git/history-analysis/trick-0143.md).

# Credential Discovery via Git History

***

Even if sensitive information like passwords or keys is removed from the current version of a file, it often remains accessible within the repository's commit history.

Navigate to the directory containing the `.git` folder (often found in the root of web application directories).

View the commit history, looking for potentially interesting commits. Pay attention to commit messages. The `git log` command is used to see the commit history. The default output from `git log` shows the author, date, and message for each commit.

```bash
git log
```

To see the changes introduced in each commit directly in the log output, you can use the `-p` or `--patch` option.

```bash
git log -p
```

Once you identify a suspicious commit ID (`<commit_id>`), view the specific changes introduced by that commit using `git show`. This command will display the changes introduced by the specified commit. By default, `git show` shows the commit message and diff for that single commit. The output is identical to using `git log -p` with the commit hash.

```bash
git show <commit_id>
```

Beyond manually reviewing commits, you can also search the commit history for specific patterns or strings. The `-S` option searches for commits that add or remove lines containing a given string. For example, to find commits that added or removed lines with "password":

```bash
git log -p -S "password"
```

Alternatively, the `-G` option searches for commits where the diff contains a line matching a given regex pattern. This can be useful for more complex patterns.

```bash
git log -p -G "password"
```

To search the history across all branches, you can add the `--all` flag to these commands.

```bash
git log -p --all -S "password"
```