Git Information Leak

In this exercise, we cover the exploitation of a website that inadvertently exposes its .git repository. This issue arises when the .git directory is not removed during deployment, leaving sensitive information accessible. By using tools like wget in recursive mode, you can download the contents of the .git directory and access the source code via git diff. This lab highlights the potential risks involved with exposing version control directories, which can lead to unauthorized access to the source code, including sensitive information such as database credentials and encryption keys.

The video for this lab provides a detailed walkthrough of the process. You start by copying the URL of the exposed .git directory and using wget to download its contents. Once downloaded, you can navigate through the files to find the necessary information to solve the exercise. The key to this exercise is hidden in a PHP comment within one of the .php files. This practical example underscores the importance of securing version control directories to prevent data leaks and unauthorized access.