Empirical Study

A Benchmark of `.git/` Pillagers

Seven open-source tools, five web-server scenarios, deterministic test repository.

Wang Yihang · updated Jul 12, 2026 · commitd3b18c2 · seed 0

§1.Setup

A ground-truth Git repository (random seed 0) is served over HTTP under five configurations: Apache and Nginx with directory listing on / off, plus a PHP-LFI entry point. Each tool runs in its own Docker container against the same target, with a 300-second timeout. Full methodology: see /methodology.

§2.Feature Support

Table 1a.✓ = supported by the tool in at least one scenario, ✗ = absent. Tools sorted by total feature count. directory listing enabled.

Tool	Version	Source code	Reflogs	Stashes	Commits	Branches	Remotes	Tags	Total
GitHacker	`1.1.10+local`	✓	✓	✓	✓	✓	✓	✓	7/7
git-dumper	`1.0.9`	✗	✓	✓	✓	✓	✓	✓	6/7
git-hacker (rbozburun)	`56285f6`	✗	✓	✓	✓	✓	✓	✓	6/7
dumpall	`0.3.2`	✓	✗	✗	✗	✗	✓	✗	2/7
GitHack	`a3d70b1`	✓	✗	✗	✗	✗	✓	✗	2/7
GitTools	`7cac63a`	✗	✓	✓	✗	✓	✓	✗	4/7
dvcs-ripper	`2c1bbc6`	✗	✗	✗	✗	✗	✓	✗	1/7

Table 1b.✓ = supported by the tool in at least one scenario, ✗ = absent. Tools sorted by total feature count. directory listing disabled.

Tool	Version	Source code	Reflogs	Stashes	Commits	Branches	Remotes	Tags	Total
GitHacker	`1.1.10+local`	✓	✓	✓	✓	✓	✓	✓	7/7
git-dumper	`1.0.9`	✗	✓	✓	✓	✓	✓	✗	5/7
git-hacker (rbozburun)	`56285f6`	✗	✓	✓	✓	✓	✓	✗	5/7
dumpall	`0.3.2`	✓	✗	✗	✗	✗	✓	✗	2/7
GitHack	`a3d70b1`	✓	✗	✗	✗	✗	✓	✗	2/7
GitTools	`7cac63a`	✗	✓	✓	✗	✓	✓	✗	4/7
dvcs-ripper	`2c1bbc6`	✗	✗	✗	✗	✗	✓	✗	1/7

§3.Completeness

Mean recovery ratio (% of ground-truth files reconstructed correctly), averaged across all five scenarios. Higher is better. Best in bold.

Table 2.Aggregate per-tool metrics, averaged across five scenarios. Best value in each column is bold.

Tool	Recovery (%)	Duration (s)	HTTP requests
GitHacker	99.2	4.5	3127
git-dumper	53.2	1.2	5178
git-hacker (rbozburun)	53.2	1.2	7195
dumpall	32.0	1.6	5889
GitHack	32.0	1.6	3862
GitTools	0.2	0.4	3147
dvcs-ripper	0.0	0.2	3151

Figure 2.Mean recovery per tool with per-scenario min–max whiskers. Tight whiskers around a high mean indicate consistent behavior across deployments.

§4.Per-Scenario Breakdown

Recovery rate (%) for every (tool, scenario) cell. Empty cells (—) mean the tool did not complete the run.

Table 3.Per-scenario recovery rate. Rows in descending mean order, GitHacker highlighted.

Tool	Apache (index on)	Apache (index off)	Nginx (index on)	Nginx (index off)	PHP-LFI	Mean
GitHacker	99.2	99.1	99.2	99.1	99.1	99.2
git-dumper	67.2	65.8	67.2	65.8	0.0	53.2
git-hacker (rbozburun)	67.2	65.7	67.2	65.7	0.0	53.2
dumpall	32.0	32.0	32.0	32.0	32.0	32.0
GitHack	32.0	32.0	32.0	32.0	32.0	32.0
GitTools	0.2	0.2	0.2	0.2	0.2	0.2
dvcs-ripper	0.0	0.0	0.0	0.0	0.0	0.0

Figure 3.Monochrome heatmap of the same data as Table 3. Cell darkness encodes recovery rate. Mono ramp chosen so the figure prints to grayscale without losing comparison.

§5.Cost vs. Completeness

Recovery rate plotted against HTTP requests issued (log scale). One point per (tool, scenario). The Pareto frontier reveals which tools recover the most while issuing the fewest requests.

Figure 4.HTTP requests vs. recovery rate, one point per (tool, scenario). Lower-left dots cost less for less return; upper-left is the Pareto sweet spot.

§6.Discussion

The largest spread is on directory-listing-disabled scenarios where some tools refuse to brute-force tag and branch names — a defensible default but one that costs 30+ percentage points in completeness. The cost-completeness scatter (FIG. 4) shows that high request counts do not buy recovery: the most aggressive tool issues 10× the requests of GitHacker on the same scenario without improving the ratio.