Information disclosure in version control history

 In this lab titled “Information Disclosure in Version Control History”, the objective was to identify and exploit sensitive data exposure caused by improper handling of version control artifacts, specifically an exposed .git directory on a web server. The engagement began with a reconnaissance phase, where I performed directory brute-forcing using dirsearch to enumerate hidden paths and commonly exposed files. During this enumeration, I discovered that the target was serving the .git directory over HTTP, which immediately indicated a high-risk misconfiguration. Exposed Git metadata often allows reconstruction of the entire source code repository, including commit history, branches, and previously deleted sensitive information.

Following the discovery, the next phase focused on extracting the repository contents from the exposed .git directory. Instead of manually reconstructing the repository structure, I used an automated Git dumping utility sourced from GitHub designed specifically for recovering exposed repositories. After cloning and setting up the tool locally, I encountered several environment-related issues that required manual remediation. These included repairing the Python virtual environment, resolving missing or incompatible dependencies in requirements.txt, adjusting filesystem permissions to allow execution, and correcting the Python shebang to ensure compatibility with python3. Once these issues were resolved, the tool successfully retrieved the .git directory and reconstructed the repository locally for offline analysis.

After extraction, I attempted to interact with the repository using standard Git tooling. However, Git initially blocked execution due to its built-in safety mechanism for untrusted repositories. This was resolved by explicitly marking the directory as safe using the following configuration:

git config --global --add safe.directory /leakedgit-lab1

This allowed Git operations to function normally within the extracted repository context. At this stage, I had full access to the repository metadata, including commit history, branches, and diff information.

With the repository fully operational, I proceeded to perform historical analysis of the codebase using Git’s logging and diff inspection capabilities. The command git log -p was particularly useful, as it not only enumerates commit history but also displays the full patch-level changes introduced in each commit. This allowed me to perform a granular review of how the code evolved over time, including additions and removals of sensitive values. During this analysis, I identified that an administrative password had been introduced in an earlier commit and subsequently removed in later revisions. However, because Git retains immutable historical snapshots of all commits, the credential remained fully recoverable from the repository history.

Ultimately, I extracted the exposed credentials directly from the historical diff output and used them to successfully complete the lab by authenticating as the administrative user and solving the lab by removing the user carlos as instructed.