Lab: Information disclosure in version control history (Information Disclosure) #lab 5

Solution:

Access the lab, While exploring the application, I discovered that the .git directory was publicly accessible:

https://LAB-ID.web-security-academy.net/.git/

https://LAB-ID.web-security-academy.net/.git/

I downloaded the Git repository using:

wget -r https://LAB-ID.web-security-academy.net/.git/

wget -r https://LAB-ID.web-security-academy.net/.git/

I do all my task in kali

• It says remove password from config so we do undo git commit message using git-cola

Open git cola using cmd: git-cola ( if not install download using apt install git-cola)

Next Undo Last Commit

Now I got password

Using the recovered credentials, I logged in as:

Username: administrator
Password: i7pz1nm2jupdpeixyqxw

Username: administrator
Password: i7pz1nm2jupdpeixyqxw

After successful authentication, I accessed the admin panel and deleted the user carlos.

Lab solved.