CWAP · Module 10 — Hidden Credentials

Attack 2 — The exposed .git directory

Animated, step-by-step: a deploy copied .git into the web root, so the entire version history — including the secret 'removed' three commits ago — is downloadable.

Module 10Secret disclosure.git exposureHigh

—

◤ Attacker workstation

🐀

you

idle

—

◤ On the wire

◤ Server

key material

—

waiting

attacker

server

hunter@cwap — bash

1× 0:00 / 0:00 step 1 / 1