Exposed Git Repository Source Code Disclosure

Overview

Room 404 is a web application security challenge focused on identifying exposed source code through a misconfigured Git repository.

The challenge demonstrates how improperly secured development files can expose sensitive application information. By performing web enumeration, I discovered an exposed .git directory that allowed me to recover the application's source code and analyze the Git repository history.

The objective of this assessment was to identify the exposed resource, retrieve the source code, investigate Git history, and locate the hidden flag.

Target Machine: http://10.48.172.61:8080

Web Directory Enumeration

The first step was performing web directory enumeration against the target application to identify hidden files and directories.

I used Gobuster because it is a fast and efficient directory and file discovery tool commonly used during web application reconnaissance. It helps identify hidden resources that may not be visible through normal website navigation, such as:

• Hidden directories
• Backup files
• Configuration files
• Development resources
• Exposed version control files

Since the challenge description mentioned:

“

"Dump the exposed source code"

I suspected that sensitive development files or source code repositories might be publicly accessible.

Command used:

gobuster dir -u http://10.48.172.61:8080 -w /usr/share/wordlists/dirb/common.txt

The scan discovered accessible paths within the web application. During further investigation, I identified that the .git directory was exposed, which could potentially allow recovery of the application's source code and repository history.

Identifying the Exposed Git Repository

During the investigation, I checked for common sensitive files and directories that may have been exposed.

I discovered that the application allowed access to the Git repository metadata.

I accessed:

http://10.48.172.61:8080/.git/HEAD

The response returned:

ref: refs/heads/main

This confirmed that the application contained an exposed Git repository.

The .git directory contains important repository information, including:

• Commit history
• Source code tracking information
• Previous changes
• Branch information

If exposed publicly, attackers may be able to recover the application's source code and inspect previous developer changes.

Recovering the Exposed Source Code

After confirming the exposed .git directory, I researched methods for recovering Git repositories from web servers.

I found git-dumper, a tool designed to extract Git repositories from exposed .git directories.

Installation:

pip install git-dumper

I used git-dumper to download the repository:

git-dumper http://10.48.172.61:8080/.git/ <recovered_repo>

The tool successfully recovered the available Git repository files.

Reviewing the Recovered Repository

After recovering the repository, I moved into the downloaded directory:

cd <recovered_repo>

I then listed all files, including hidden files:

ls -la

The output revealed the repository structure, including the .git directory.

The .git directory was important because it contained the complete Git history of the application.

Investigating Git Commit History

Since the repository history was available, I investigated previous commits made by the developer.

I entered the Git directory:

cd .git

Then I reviewed the commit history:

git log

The command displayed the available commits within the repository.

The latest commit contained a unique commit hash that could be used to inspect the changes made during that commit.

Extracting Information From Git Commit

After identifying the latest commit hash, I copied the commit ID and used:

git show <commit_hash>

Example:

git show xxxxxxxxxxxxx

The command displayed the details of the commit, including the changes introduced.

During the investigation, the hidden flag was revealed inside the Git commit history.

This demonstrates an important security issue: removing sensitive information from the current version of an application does not always remove it from the repository history.

Vulnerability Identified

Exposed Git Repository

The application exposed its .git directory, allowing unauthorized access to repository metadata and source code history.

Category:

Information Disclosure

Affected Component:

• Web server configuration
• Application deployment process

Lessons Learned

This challenge demonstrated how a simple deployment mistake can expose an application's source code and development history.

The assessment followed a complete discovery process:

1. Web directory enumeration using Gobuster
2. Identification of exposed .git directory
3. Repository recovery using git-dumper
4. Git history analysis using git log
5. Commit investigation using git show

Protecting development resources and properly configuring production environments are essential practices for preventing source code disclosure.

Conclusion

Room 404 highlights the risks of exposing version control repositories in web applications.

Through enumeration and Git repository analysis, I was able to recover the application's source code and identify sensitive information stored within the commit history.

This vulnerability emphasizes the importance of secure deployment practices, proper web server configuration, and regular security assessments.