gitlab-public-recon

Mine public GitLab instances for exposed credentials and CI/CD tokens.

1.1k|191|Updated Jun 24, 2026

Search Tags:#secrets #gitlab #recon #public-repos #source-leak #ci-tokens #internal-ips

One-click install

npx skills add https://github.com/uphiago/recon-skills --skill gitlab-public-recon

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: gitlab-public-recon
Source: https://github.com/uphiago/recon-skills/tree/main/recon/gitlab-public-recon
Command: npx skills add https://github.com/uphiago/recon-skills --skill gitlab-public-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually scanning public self-hosted GitLab instances for sensitive exposure like credentials, internal infrastructure details, and CI/CD secrets is time-consuming and often misses high-risk assets hidden across multiple public repositories.

Core Features & Use Cases

Enumerate all public projects on a target GitLab instance via its unauthenticated API
Extract sensitive files including .env configs, deploy scripts, SSL private keys, and database dumps from public repos
Analyze CI/CD pipeline definitions and commit history for exposed tokens, developer contact info, and internal IP addresses
Use case: For a government target with a gitlab.cge.rj.gov.br subdomain, this skill can quickly surface 461K CPF records, internal deployment IPs, and open user registration flags from public repositories.

Quick Start

Use the gitlab-public-recon skill to scan the target GitLab instance at gitlab.target.com for public projects, sensitive files, and exposed CI/CD tokens.

Frequently Asked Questions about gitlab-public-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find exposed secrets and internal IPs in public GitLab repositories?▼

To find exposed secrets in public GitLab repositories, you can enumerate public projects via unauthenticated GitLab API v4, download repository files, and analyze commit history to extract credentials, internal IPs, and CI/CD tokens.

Can I scan a self-hosted GitLab instance for sensitive source code without authentication?▼

Yes, you can scan unauthenticated self-hosted GitLab instances by querying the public API v4 to enumerate accessible projects and extract sensitive files like .env configs, deploy scripts, SSL private keys, and database dumps.

What tools do I need to extract CI tokens and internal IPs from GitLab public repos?▼

Extracting CI tokens and internal IPs from GitLab public repos requires curl, python3, and jq to interact with the unauthenticated GitLab API v4, download repository files, and parse pipeline definitions.

How does analyzing GitLab commit history help find leaked credentials and deployment IPs?▼

Analyzing GitLab commit history reveals exposed tokens, developer contact info, and internal deployment IPs hidden in previous repository states or CI/CD pipeline definitions that are often missed during manual scanning.

What is the best way to automate reconnaissance on a target's GitLab subdomain?▼

The best way to automate GitLab subdomain reconnaissance is using a skill that systematically mines the target instance via API v4 to surface sensitive source leaks, CI/CD tokens, and internal infrastructure details across all public projects.

Are there limitations when mining public GitLab instances for exposed user data and secrets?▼

Limitations include requiring the target to use a self-hosted GitLab instance identified through subdomain enumeration or certificate transparency logs, and the target must have public projects accessible without authentication.