> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/git/history-analysis/trick-0369.md).

# Credential Discovery In Git History

***

When a Git repository's history is accessible (e.g., via a `.git` directory exposure), sensitive data like credentials or configuration details might be found in past commits, even if removed in the latest version.

Navigate to the discovered `.git` directory. If encountering "unsafe repository" errors, often indicated by messages like "detected dubious ownership", add the directory to Git's safe list:

```bash
git config --global --add safe.directory /path/to/git/dir
```

Analyze the commit history to identify potential leaks. One of the most common ways to discover sensitive information is by reviewing the commit history. Useful commands include:

```bash
git log -p         # View diffs for all commits
git reflog         # See history of HEAD changes
git log --all --decorate --oneline --graph # Visualize history
```

To search for specific patterns like passwords, secrets, keys, or tokens within commit messages and diffs across all branches, you can use:

```bash
git log --all -p --grep='password\|secret\|key\|token'
```

A more comprehensive search that scans all reachable commits for patterns within the file contents themselves, regardless of whether they were added or removed in a specific commit, can be performed with `git grep`:

```bash
git grep -i -n "password\|secret\|key\|token" $(git rev-list --all)
```

This command searches for the specified patterns in all reachable commits, ignoring case (`-i`) and showing line numbers (`-n`).

Alternatively, to find commits that specifically added or removed a given string (`-S`) or matched a regex (`-G`):

```bash
git log -S 'string' # Searches for commits that add or remove a given string
git log -G 'regex'  # Searches for commits whose diffs contain a line matching the regex
```

Inspect individual commits (`git show <commit_hash>`) to view their details. If a sensitive file was removed in a commit, you can retrieve its content from a previous state. For instance, to retrieve a file from the parent commit of the one where it was removed:

```bash
git checkout <commit_hash>^ -- <file_path>
```