> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/git/trick-0225.md).

# Git History Extraction

***

To extract the history and source code from a publicly accessible `.git` directory, use `gitdumper.sh` to download the repository contents:

```bash
./GitTools/Dumper/gitdumper.sh http://target.com/.git/ dumped
```

This command saves the raw git objects into the specified output directory (e.g., `dumped`). This tool dumps a git repository from a website which has the `.git` directory exposed.

Next, use `extractor.sh` to reconstruct the repository's history and files from the dumped objects:

```bash
./GitTools/Extractor/extractor.sh dumped extracted
```

This extracts the committed files and history into another directory (e.g., `extracted`), allowing you to browse the source code and identify potentially sensitive information. This tool extracts commits from a git repository dumped with gitdumper.sh.

Alternatively, if the server configuration allows it, a simple `git clone` command might work directly:

```bash
git clone http://target.com/.git/
```

Another tool, GitHacker, a Python script, can also be used to hack `.git` folders:

```bash
python3 GitHacker.py http://target.com/.git/
```

Once the repository is extracted into the `extracted` directory (or cloned directly), you can navigate into it and use standard Git commands to analyze the contents and history.

View the commit history using:

```bash
git log
```

This command shows the list of commits, including commit hashes, authors, dates, and commit messages. To view the commit history along with the patch (diff) for each commit, which shows the exact changes made in each step:

```bash
git log -p
```

To restore the files in the working directory to the state of the latest commit, use:

```bash
git checkout .
```

This checks out all files from the current HEAD commit into the filesystem. A more modern command for restoring working tree files is `git restore .`.

To find objects in the repository that are present but not reachable from any branch or tag, such as deleted files or commits that were reset away, use:

```bash
git fsck --lost-found
```

This command helps discover 'lost' objects (like dangling commits, blobs, or trees) and places references to them in the `.git/lost-found` directory. Using `git fsck --full` can perform a more thorough check.

To see a log of where the HEAD and branch tips have been, which can be useful for finding commits that are no longer in the main history:

```bash
git reflog
```

You can also jump to the state of a specific commit by using its hash:

```bash
git reset --hard <commit_hash>
```

Replace `<commit_hash>` with the identifier of the commit you wish to examine. To check out a specific commit without resetting the branch pointer, you can use `git checkout <commit-hash>`.

To view the content of a specific object (commit, tree, or blob) found via `git fsck` or other means, use `git show` with the object's hash:

```bash
git show <object-hash>
```

This is particularly useful for viewing the content of lost blobs (files) or trees (directories).

To recover a specific file from a particular commit, you can use:

```bash
git checkout <commit-hash> -- <file-path>
```

Or using the modern `git restore` command:

```bash
git restore --source=<commit-hash> <file-path>
```

Replace `<commit-hash>` with the commit where the file existed and `<file-path>` with the path to the file.

To search for specific text patterns within the committed files across the history, the `git grep` command is useful. For example, to search the entire history for "password":

```bash
git grep -n "password" $(git rev-list --all)
```

Or to search within a specific commit:

```bash
git grep 'pattern' <commit_hash>
```

To search for patterns within commit messages themselves, use `git log --grep`:

```bash
git log --grep "password"
```

To compare the differences between two specific commits, use:

```bash
git diff <commit1> <commit2>
```

Replace `<commit1>` and `<commit2>` with the respective commit hashes or references.

Analyzing the commit history, looking for sensitive keywords in code and commit messages, examining deleted files or lost objects using `git fsck` and `git show`, and recovering specific files from past commits are key techniques for extracting valuable information from an exposed `.git` repository.