Git is everywhere these days and so is the danger of accidentally exposing the git repositories publicly. This write-up is based on TryHackme’s room named Git Happens which highlights this issue and the possible dangers and exposure this mistake can cause to any company if they are not careful. This room can be found here:-
This is kind of a easy room if you are familiar with git version control system and few basic git commands.The task is simple and we have to find a super secret password.
Running NMAP results in the following:
nmap -sC -sV 10.10.38.53
That is - we have a Git Repository exposed via Port 80! Lets browse this:
We can manually go through each of these directories or we can use some tool to get this repo locally and try to find out the password . I found a tool named GitTools on github which was super useful:
