Exploiting publically exposed Version Control System
2 likes5,190 views
This document discusses exploiting version control systems (VCS) like Git, SVN, and Mercurial. It describes how VCS work and why they can be exploited, noting that auto-deployment features can allow code to be deployed by committing changes. It provides an overview of common VCS files and folders that can be used to extract code from repositories. Tools for extracting code from VCS are also listed. The document concludes with a demonstration of exploiting VCS and checks that can be done to find exposed VCS files.
Exploiting publically exposed Version Control System
- 1. EXPLOITING VERSION CONTROL SYSTEMS PILLAGING FOR FUN AND PROFIT BY ANANT SHRIVASTAVA
- 2. ANANT SHRIVASTAVA Information Security Consultant Admin - Dev - Security null + OWASP + G4H and @anantshri Trainer : Blackhat USA, NullCon, g0s, c0c0n, RootConf Speaker : Nullcon, c0c0n, ClubHack, RootConf http://anantshri.info
- 3. WHAT IS VCS Version Control System The hip / developers way of deploying code Supports Auto-Deployment on commit
- 4. WHY EXPLOIT Coz its fun Its like a golden ticket Auto-deployment if available makes it more hip.
- 5. VCS 101 Type FOLDER GIT .git SVN .svn Mercurial .hg
- 8. TOOLS 1. SVN-extractor (Only SVN) (on top coz i wrote it) 2. DVCS-pillage (lacks SVN support) 3. dvcs-ripper (alternative implementation covers svn too)
- 9. DEMO TIME NOTE: ALL DEMO's are prepared while in sleep deprived state.
- 12. SVN
- 13. PHEW DEMO DONE
- 14. QUICK CHECKS while read p; do echo "Input: "$p echo "CHECK: SVN entries http" curl -I echo "CHECK: SVN entries https" curl -k -I echo "CHECK: SVN wcdb" curl -I echo "CHECK: SVN wcdb https" curl -k -I done<$1 http://$p/.svn/entries https://$p/.svn/entries http://$p/.svn/wc.db https://$p/.svn/wc.db
- 15. ANY QUESTIONS
- 16. ANANT SHRIVASTAVA Information Security Consultant Admin - Dev - Security null + OWASP + G4H and @anantshri Trainer : Blackhat USA, NullCon, g0s, c0c0n, RootConf Speaker : Nullcon, c0c0n, ClubHack, RootConf http://anantshri.info