Git

Dump .git directory

If Directory brute-forcing reveals .git dump the source code:

git-dumper http://cat.htb/.git ~/Documents/CTF/HTB/cat.htb/dump

Is a good practice to restore all files for further enumeration

git restore .

Restore the staged changes and see the differences

git restore --staged . && git diff

When error messages provide specific text, use them to locate validation code

grep "invalid characters" *
grep -r "forbidden" ./
find . -name "*.php" -exec grep -l "validation" {} \;

Check for common PHP sanitization functions

• htmlspecialchars() - Converts special characters to HTML entities

• filter_var() - Validates and sanitizes data

• addslashes() - Escapes quotes

• strip_tags() - Removes HTML/PHP tags

Enumeration

Repository Status

git status

Shows changes staged for the next commit

git diff --cached

Check Commit

git show b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae

Show all the branches in the repository

git branch -a

Show the commit history across multiple branches

git show-branch

Logs

git log

Look for a file across the entire history

git log --all --full-history -- .env

Shows a sorted list of unique files changed in any commit across all branches

git log --all --name-only --pretty=format: | sort | uniq

Lists files changed in any commit across all branches that contain "env" in their name

git log --all --name-only --pretty=format: | grep -i env

Remote Repository

Check your remote URL

git remote -v

Remote URL to SSH

git remote set-url origin [e-mail]:b0llull0s/AI-Maths.git

Branches

Fetch the changes to local

git fetch origin

Merge Branch

git merge <branch_name>

Delete Branch

git branch -D <branch_name>

Create and switch to a new branch

git checkout <branch_name>

In case you can to create a feature branch

git checkout -b feature-branch

Pull the latest changes

git pull origin dev

Switch to another branch

git switch <branch-name>

Push the changes

git push origin <branch_name>

Fetch changes to local

git fetch

History Modification

Removes .env file from the history in all branches and tags

git filter-branch --force --index-filter \ "git rm --cached --ignore-unmatch .env" \ --prune-empty --tag-name-filter cat -- --all