Even with directory listings disabled, you could request http://example.com/.git/refs/heads/master http://example.com/.git/refs/heads/master to get the sha of m

Even with directory listings disabled, you could request http://example.com/.git/refs/heads/master http://example.com/.git/refs/heads/master to get the sha of master, then get http://example.com/.git/objects/<sha http://example.com/.git/objects/<sha 2 char>/<rest of sha> to download the data for that one sha, then you can get the rest. Wouldn't be terribly difficult to write a script to crawl it. Git's format is well known and documented.