Inspect source, backups, configuration and repository artifacts

Needs: Readable application artifact or a complete recoverable repository; preserve the public-source scope

Shell commands

# Baseline
curl -sk http://TARGET:PORT/robots.txt
curl -sk http://TARGET:PORT/sitemap.xml
curl -sk http://TARGET:PORT/.git/HEAD
curl -sk http://TARGET:PORT/openapi.json
curl -sk http://TARGET:PORT/swagger.json

# Baseline
curl -ski http://TARGET:PORT/.git/HEAD
curl -ski http://TARGET:PORT/.git/config

# Baseline
git-dumper http://TARGET:PORT/.git/ repo-output
git -C repo-output status
git -C repo-output log --oneline --all --decorate
git -C repo-output log -p --all

Decisive output: a path, parameter, API schema, object identifier, component or secret-bearing artifact that creates a specific next request. Source disclosure is not command execution.

Shell commands

git-dumper is an optional third-party helper; install on demand in an isolated environment only when the exposure has been confirmed. Manual object recovery is possible but slower.

# Baseline
rg -ni 'password|passwd|token|secret|api[_-]?key|private[_-]?key' repo-output
git -C repo-output log --all -S'password' --oneline
git -C repo-output log --all -G'pass(word)?|secret|token' --oneline

# Inspect candidate commits without dumping all history
git -C repo-output show COMMIT -- PATH
git -C repo-output diff COMMIT^ COMMIT -- PATH

Validate freshness, identity and compatible use. Removed historical values are often rotated or environment-specific.

Verify → Confirm actual file/history content and distinguish a historical secret from a usable current credential.

If it fails → A 200 soft-404 or incomplete object database is not a recovered repository. Compare known-missing paths and record missing history. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A product/version clue, advisory or component-specific public PoC → Match a public exploit to the actual component and configuration
Needs: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect
An API/schema, numeric object IDs, hidden fields or different HTTP methods → Map parameters, API methods, objects and writable properties
Needs: A valid request and explicit role/object ownership; exact input format and content type

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Inspect source, backups, configuration and repository artifacts

USE WHEN: JavaScript endpoints, backup names, exposed configuration or Git metadata
STARTING ACCESS: A reachable HTTP application and recorded anonymous or authenticated request state
RESULT: Hidden functionality, version clues or typed credential artifacts

Recognize the clue

Inspect linked JavaScript/source, robots/sitemaps, relevant backups and a bounded Git metadata check from the mapped web application.

curl -sk http://TARGET:PORT/robots.txt
curl -sk http://TARGET:PORT/.git/HEAD

SYNTHETIC EXAMPLE OUTPUT

robots.txt: Disallow: /INTERNAL_PATH/
.git/HEAD: ref: refs/heads/main

Means: The path and Git reference are investigation leads; neither proves a working secret or complete repository.

Confirm: Compare missing-path controls, retrieve actual permitted artifacts and verify recovered history/account context.

After validation: Relevant source/history is recoverable and exposes a typed artifact: inspect it through the credential workflow.
Ruled out in this context: The same body is returned for arbitrary missing paths: reject the apparent metadata exposure.
Still inconclusive: HEAD without objects leaves repository recovery incomplete; document available content instead of inventing history.

Troubleshooting: A 200 soft-404 or incomplete object database is not a recovered repository. Compare known-missing paths and record missing history.

Also inspect HTML comments, hidden inputs, form actions, linked JavaScript, route strings, source-map references, cookies and response headers.

Decisive output: a path, parameter, API schema, object identifier, component or secret-bearing artifact that creates a specific next request. Source disclosure is not command execution.

A readable HEAD/config supports exposed repository metadata. A 403, redirect or generic template is not proof. Preserve the correct host header/base path.

If authorized, recover into a new local directory with a purpose-built tool and inspect locally:

git-dumper is an optional third-party helper; install on demand in an isolated environment only when the exposure has been confirmed. Manual object recovery is possible but slower.

Inspect candidate commits without dumping all history:

Validate freshness, identity and compatible use. Removed historical values are often rotated or environment-specific.

Why it works

Client code and repository history can preserve endpoints and removed secrets. An exposed Git HEAD proves metadata exposure; repository completeness and secret validity require separate checks.

Worked example · hypothetical

Observation: Git metadata is exposed. Test: recover only available objects and inspect history. Illustrative output: a removed database connection string. Interpretation: classify the account and validate current database access.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗