Step 4: Exploring /.git content

Once the crawling is completed, you will see a path named .git. We’ll explore that directory. Go to the address bar, add /.git, and press Enter.

You will see some files related to Git.

To analyze these files, we need to download a copy of the entire directory using the following command:

wget -r https://0aef00d6038cfdc382dd38d3007d002e.web-security-academy.net/.git

This will start downloading the entire content of .git to your Kali Linux system.

Note: The URL may change due to inactivity, so you might need to start a new session. However, the steps remain the same.

Once the download is completed, navigate to the downloaded directory (e.g., "0a8900ac0499438880ce7b2b001a00ae.web-security-academy.net") using the cd command.

Once you’re inside this directory, use:

ls -al

Once you’re inside this directory use “ls -al” to display the hidden files and folders. Once command is executed you’ll se .git folder. Navigate to that folder and once again execute “ls -al” command, you’ll see the following files:

to display hidden files and folders. After executing the command, you will see the .git folder. Navigate to that folder and run ls -al again to view its contents.

Now, to read the contents of the config file you need to use an application called git-cola.

In the terminal, type:

git-cola

A window will pop up. Here, you will see two files: admin.conf and admin_panel.php. When you select admin.conf, you will see a line at the bottom containing "ADMIN_PASSWORD".

To view the previous commit of that file, go to Commit in the toolbar and click on Amend Last Commit.

You will see a previous version of admin.conf, which contains the admin password.

This is how we found the administrator password.

Using the found password, log in to the administrator account.

Once logged in, click on the Admin Panel.

You will be redirected to the Users page, where you can see two users: Weiner and Carlos. To complete the lab, you need to delete Carlos.

Step 5: Completing the Lab

Once you delete Carlos, check your browser, and you will see the message:
“Congratulations, you have solved the lab.”

That’s it! You’ve successfully solved the Information disclosure in version control history lab.

Thank you for taking the time to read my article!
I hope you found it informative and valuable. If you enjoyed it, please consider liking the article, following me for more content, and sharing it with others who might benefit from it. Your support means a lot!