gitlab-public-recon

1# GitLab Public Recon Skill
2 
3Enumerate publicly accessible GitLab repositories to extract source code, credentials, internal IPs, CI/CD tokens, deployment configurations, and environment files. GitLab instances with registration enabled or public visibility expose the entire development infrastructure. Confirmed on gov-finance-portal (3 public repos, 461K CPFs, internal IP 10.11.82.75, CI/CD tokens), dev-agency (GitLab with SSL private keys), and fitness-chain (Firebase SA keys in repos).
4 
5## When to Use
6 
7- Target has a `gitlab.` subdomain or self-hosted GitLab instance.
8- crt.sh reveals `gitlab.target.com` in certificates.
9- After `subdomain-enumeration` discovers GitLab hosts.
10- After `js-secrets-extraction` finds GitLab CI/CD references.
11- Target is a government agency or large enterprise (common self-hosted GitLab users).
12 
13## Prerequisites
14 
15- `terminal` with curl, python3, jq.
16- GitLab URL (e.g., `https://gitlab.target.com`).
17- GitLab API is accessible without authentication for public resources.
18 
19## How to Run
20 
21```bash
22# List public projects
23curl --max-time 30 --connect-timeout 10 -sk "https://gitlab.TARGET.com/api/v4/projects?visibility=public&per_page=100" | jq '.[].path_with_namespace'
24 
25# Read a file from a public repo
26curl --max-time 30 --connect-timeout 10 -sk "https://gitlab.TARGET.com/api/v4/projects/GROUP%2FPROJECT/repository/files/PATH/raw?ref=main"
27```
28 
29## Quick Reference
30 
31| API Endpoint | What It Returns | Risk |
32|-------------|-----------------|------|
33…