Security Cipher
Home Blog About Us
Resources β–Ό
βœ… Security Checklists Hub πŸ—ΊοΈ Penetration Testing Roadmap 🌐 Web Application Security Checklist πŸ€– OWASP Top 10 for LLM Applications 🧠 LLM AI Security Checklist πŸ› οΈ Security Tools 🎯 Penetration Testing Tricks πŸ“„ Secure Code Explain πŸ“– Vulnerability Explain ☁️ AWS Cloud Security Checklist
My Resume
Contact UsContact
← Security Tools View on GitHub

GitDumper

Dump a git repository from a website when .git is exposed.

git-dumper

A tool to dump a git repository from a website.

Install

This can be installed easily with uv:

uv tool install git-dumper

Alternatively, you can install it via pip. Note that modern Python environments may require you to use a virtual environment or the --user flag to avoid conflicts:

# Using a virtual environment
python3 -m venv .venv
source .venv/bin/activate
pip install git-dumper

# OR using the --user flag
pip install --user git-dumper

Usage

usage: git-dumper [options] URL DIR

Dump a git repository from a website.

positional arguments:
  URL                   url
  DIR                   output directory

optional arguments:
  -h, --help            show this help message and exit
  --proxy PROXY         use the specified proxy
  -j JOBS, --jobs JOBS  number of simultaneous requests
  -r RETRY, --retry RETRY
                        number of request attempts before giving up
  -t TIMEOUT, --timeout TIMEOUT
                        maximum time in seconds before giving up
  -u USER_AGENT, --user-agent USER_AGENT
                        user-agent to use for requests
  -H HEADER, --header HEADER
                        additional http headers, e.g `NAME=VALUE`
  --client-cert-p12 CLIENT_CERT_P12
                        client certificate in PKCS#12 format
  --client-cert-p12-password CLIENT_CERT_P12_PASSWORD
                        password for the client certificate
  -b BRANCH, --branch BRANCH
                        additional branch name to check for (repeatable)

Example

git-dumper http://website.com/.git ~/website

Disclaimer

Use this software at your own risk!

You should know that if the repository you are downloading is controlled by an attacker, this could lead to remote code execution on your machine.

Build from source

Simply install the dependencies with pip:

pip install -r requirements.txt

Then, simply use:

./git_dumper.py http://website.com/.git ~/website

How does it work?

The tool will first check if directory listing is available. If it is, then it will just recursively download the .git directory (what you would do with wget).

If directory listing is not available, it will use several methods to find as many files as possible. Step by step, git-dumper will:

  • Fetch all common files (.gitignore, .git/HEAD, .git/index, etc.);
  • Find as many refs as possible (such as refs/heads/master, refs/remotes/origin/HEAD, etc.) by analyzing .git/HEAD, .git/logs/HEAD, .git/config, .git/packed-refs and so on;
  • Find as many objects (sha1) as possible by analyzing .git/packed-refs, .git/index, .git/refs/* and .git/logs/*;
  • Fetch all objects recursively, analyzing each commits to find their parents;
  • Run git checkout . to recover the current working tree
Press Escape to close the search panel.

Donate

Buy me a Coffee

Penetration Testing Services - Fiverr

Buy me a Coffee

Penetration Testing Services

penetration Testing Services

Web Application Security Quiz

Web Application Security Quiz

Daily Bug Bounty Writeups - Twitter

Daily Bug Bounty Writeups

Download our Latest Android Application

Guide for Penetration Testing

Daily Bug Bounty Writeups - Telegram

Daily Bug Bounty Writeups

Author

Piyush
Senior Product Security Engineer

Ethical Hacker || Penetration Tester || Gamer || Blogger || Application Security Engineer

READ ARTICLE

Donate

Buy me a Coffee

Recent Posts

  • The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    August 25, 2026/
    0 Comments
  • RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
    RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
    August 19, 2026/
    0 Comments
  • Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
    Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
    August 13, 2026/
    0 Comments

Follow Us

SecurityCipher

Practical security guides, vulnerability deep-dives, and hands-on resources for bug bounty hunters and penetration testers.

Useful Links

  • Start Here
  • Security Checklists
  • Writeup Checklists
  • Cybersecurity Jobs
  • CVE Lookup
  • Bug Bounty Programs
  • Security Conferences
  • Payload Cheatsheets
  • Interview Prep
  • Blogs
  • About
  • Contact
  • RSS Feed

Recent Post

  • The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
  • RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
  • Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
Β© 2026 SecurityCipher. All rights reserved. Privacy Policies Β· Terms & Conditions