Git and SVN

Default Ports: 9418 (Git), 3690 (SVN), 80/443 (HTTP/HTTPS)

Git and SVN are source code version control systems. In pentests, exposed repositories can leak source code, commit history, credentials, deployment scripts, CI configs, and internal architecture.

Connect

Using Git

Use Git clients to test clone and ls-remote access.

git ls-remote git://target.com/project.git
git clone git://target.com/project.git
git clone https://target.com/project.git

Using SVN

Use SVN clients to list repositories and checkout accessible paths.

svn list svn://target.com/
svn checkout svn://target.com/project
svn list https://target.com/svn/project

Using curl

HTTP checks reveal exposed .git, SVN, cgit, GitWeb, or repository portals.

curl -I https://target.com/.git/
curl -I https://target.com/.svn/
curl -I https://target.com/git/
curl -I https://target.com/svn/

Recon

Service Detection with Nmap

Scan native Git, native SVN, and web repository ports.

nmap -p 80,443,3690,9418 -sV target.com
nmap -p 80,443 --script http-title,http-headers target.com
nmap -p 3690,9418 --open -sV 10.10.10.0/24

Web Repository Discovery

Look for common repository interfaces and leaked metadata directories.

ffuf -u https://target.com/FUZZ -w wordlist.txt -mc all
curl -I https://target.com/.git/HEAD
curl -I https://target.com/.svn/entries
curl -I https://target.com/.git/config

Git Protocol Discovery

The Git protocol may allow unauthenticated clone or repository listing.

git ls-remote git://target.com/repo.git
nmap -p 9418 --script git-info target.com

SVN Discovery

SVN may expose repository roots, branches, and revision history.

svn list svn://target.com/
svn info svn://target.com/project
nmap -p 3690 -sV target.com

Enumeration

Exposed .git Enumeration

An exposed .git directory can allow full source recovery.

curl https://target.com/.git/HEAD
curl https://target.com/.git/config
git-dumper https://target.com/.git/ ./dumped-git

Git Repository Enumeration

After cloning, enumerate branches, tags, remotes, and logs.

git branch -a
git tag
git remote -v
git log --oneline --all --decorate

Git History Enumeration

Secrets often appear in old commits even when removed later.

git log --all --stat
git grep -n -I 'password\|secret\|token\|apikey' $(git rev-list --all)
gitleaks detect --source .
trufflehog git file://$(pwd)

SVN Repository Enumeration

SVN history and properties can expose old files and metadata.

svn list -R svn://target.com/project
svn log svn://target.com/project
svn info svn://target.com/project
svn propget -R svn:externals svn://target.com/project

SVN Working Copy Enumeration

Leaked .svn directories can expose source and repository URLs.

curl https://target.com/.svn/entries
curl https://target.com/.svn/wc.db -o wc.db
sqlite3 wc.db 'select local_relpath, repos_path from NODES limit 20;'

Attack Vectors

Anonymous Clone

Anonymous clone exposes current source and sometimes full history.

git clone git://target.com/project.git
git clone https://target.com/project.git
svn checkout svn://target.com/project

Exposed Metadata Directory

Leaked .git or .svn directories can reconstruct private code.

git-dumper https://target.com/.git/ ./dumped-git
svn checkout https://target.com/.svn/ ./dumped-svn

Secret Leakage

Search source and history for credentials and tokens.

gitleaks detect --source .
trufflehog git file://$(pwd)
rg -n 'password|passwd|secret|token|apikey|private_key|BEGIN RSA|AWS_ACCESS_KEY' .

Writable Repository Access

Write access can alter code, CI configs, hooks, or release assets.

git push origin test-branch
svn commit -m "authorized test commit"

CI/CD Pivot

Repository files often reveal build systems and deployment secrets.

rg -n 'Jenkinsfile|gitlab-ci|github/workflows|deploy|kubeconfig|helm|docker login|registry' .
rg -n 'NEXUS|ARTIFACTORY|HARBOR|AWS_|AZURE_|GCP_|DOCKER_' .

Post-Exploitation

Repository Impact Review

Document branches, tags, remotes, and sensitive paths.

git branch -a > branches.txt
git tag > tags.txt
git remote -v > remotes.txt
git log --oneline --all > commits.txt

Secret Validation

Do not use secrets broadly; validate scope safely and report rotation needs.

gitleaks detect --source . --report-format json --report-path gitleaks.json
trufflehog filesystem . --json > trufflehog.json

Internal Mapping

Source code reveals endpoints, hostnames, and dependencies.

rg -n 'https?://|jdbc:|mongodb://|redis://|amqp://|ldap://|kafka|s3://' .
rg -n 'prod|staging|internal|corp|cluster|namespace|tenant' .

Useful Tools

Tool	Purpose
git	Git clone and history review
svn	SVN listing and checkout
git-dumper	Exposed .git recovery
curl	Metadata path checks
ffuf	Directory discovery
gitleaks	Secret scanning
trufflehog	Secret scanning
sqlite3	SVN wc.db review

Security Misconfigurations

Misconfiguration	Risk
Anonymous Git clone	Source and history exposure
Anonymous SVN checkout	Source and revision exposure
Exposed .git directory	Full repository reconstruction
Exposed .svn directory	Working copy and source leakage
Secrets in history	Credential compromise
Writable repository access	Supply-chain compromise
CI/CD configs exposed	Build and deployment pivot
Weak repository auth	Unauthorized source access