Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dumping Git Data from Misconfigured Web Servers

netspi.com | blog | #git | #pentesting | #web-security | #information-disclosure | #source-code-exposure | #wget

Summary

Web servers exposing their .git directory hand attackers the full repository history: the article covers finding exposed repos, mirroring them with wget, and recovering source and config data.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Jira Information Gathering
Details Jira misconfigurations that leak usernames, emails, and popular filters to anonymous users, and walks admins through fixing Global Permissions like Browse Users.
blog · netspi.com
Playing with Content-Type – XXE on JSON Endpoints
By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.
blog · netspi.com
Parsing SVN Entries Files with PowerShell
Leftover SVN entries files on web servers can disclose hidden pages, config files, and source code. A PowerShell script automates parsing entries files to enumerate exposed directories and files.
blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
Since its formal recognition by the security community in 2007 on the OWASP Top Ten list, Cross Site Request Forgery (CSRF) has stepped out of the shadows and joined the ranks of vulnerability all-stars like Cross Site Scripting (XSS) and SQL injection.
research · aretiq.ai
CVE-2026-48827 — Apache MINA SSHD sshd-git Path Traversal Info Disclosure
CVE-2026-48827: path traversal in Apache MINA SSHD's sshd-git module lets authenticated users escape the Git root via ../ to read from or push to arbitrary repositories.
blog · netspi.com
Vibe Coding: A Pentester’s Dream
NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.
back