GitLab Public Recon Skill

Enumerate publicly accessible GitLab repositories to extract source code, credentials, internal IPs, CI/CD tokens, deployment configurations, and environment files. GitLab instances with registration enabled or public visibility expose the entire development infrastructure. Confirmed on gov-finance-portal (3 public repos, 461K CPFs, internal IP 10.11.82.75, CI/CD tokens), dev-agency (GitLab with SSL private keys), and fitness-chain (Firebase SA keys in repos).

When to Use

• Target has a gitlab. subdomain or self-hosted GitLab instance.
• crt.sh reveals gitlab.target.com in certificates.
• After subdomain-enumeration discovers GitLab hosts.
• After js-secrets-extraction finds GitLab CI/CD references.
• Target is a government agency or large enterprise (common self-hosted GitLab users).

Prerequisites

• terminal with curl, python3, jq.
• GitLab URL (e.g., https://gitlab.target.com).
• GitLab API is accessible without authentication for public resources.

How to Run