The Folder That Shipped Itself: An Exposed .git Directory
The challenge
Verdanta deploys its shop by running git pull on the web server, which is tidy until you notice the whole .git directory is sitting inside the web root, served to anyone who asks. A repository is not just source: it remembers how it talks to its origin. From the recon box, confirm the directory is exposed and read the one file that turns a careless deploy into someone else's credential. Report the deploy token it leaks.
What you'll learn
- Confirm an exposed .git directory over HTTP
- Read .git/config and find the origin remote URL
- Recognise credentials inlined in a clone URL as a leaked secret
- Explain why an exposed .git leaks far more than one file
- State how to deploy without placing .git in the web root
Skills tested
Prerequisites
- Using curl
- What a git remote is
How it works
Deploying by running git pull on the server is convenient and leaves the entire .git directory next to the site. If that directory is inside the web root, the server will hand its files to anyone who asks, with no authentication.
.git/config records the origin remote. When a repository was cloned over HTTPS with a username and password in the URL, git writes that URL, secret and all, straight into config. One request returns the deploy credential.
It is worse than one file: .git/objects and the packs let an attacker rebuild the full history, recovering every secret ever committed and later removed, every internal path and every prior version of the code.
Common mistakes
- Stopping at
.git/HEAD. It confirms exposure but only names the branch; the credential is inconfig. - Reading the site root. The homepage is clean; the leak is under
/.git/. - Answering the username or host.
verdanta-ciandgit.verdanta.exampleare context; the token is the value after the colon. - Assuming you need the whole history. Here one file is enough, though the history is recoverable too.
How to defend against it
Keep the repository out of the served tree and rotate what leaked.
- Deploy from a built artifact or a
git archiveexport, or keep the working checkout outside the document root. Never serve.git. - Block access to dot-directories and dot-files at the web server as defence in depth.
- Do not inline credentials in a remote URL. Use a credential helper or a deploy key, and rotate any token that was ever written into a URL.
- Treat a credential that reached
.git/configas already public.