One in every 600 websites has .git exposed • Hacker News Board

Re: One in every 600 websites has .git exposed

#171

Post by [deleted] » Mon, Jul 27, 2015, 11:44 AM UTC

Negitivefrags wrote: post #117

phantom_oracle wrote: post #30

Imagine you implement every type of possible security... Keeping your entire server-stack up-to-date, making sure you have SSL, using strong encryption for logging-in, hashing the passwords, making sure your server can only be reached via SSH, adding firewalls, filters, etc. etc. Then some hacker in Eastern Europe comes along (or some beginner at the NSA/GCHQ) and finds out that your .git is exposed and somehow gains…

This is the asymmetric nature of security in general. You only need to make a single mistake and you are hosed. Your attacker can fail an arbitrary number of times and only needs to succeed once. If you are 99.9% likely to make the right call on anything that could have a security impact then you only need to make 1000 decisions before you probably screwed one up and have a hole. Some would say this means true securi…

[deleted]

Re: One in every 600 websites has .git exposed

#172

Post by pmx » Mon, Jul 27, 2015, 12:19 PM UTC

juliangregorian wrote: post #158

vog wrote: post #145

Earlier quoted context omitted.

You seem to imply this is a novel attack vector. But it's really just an instance of a very old mistake: Don't use the root of your app as document root! It's really as simple as that. Almost all modern apps have a subdirectory "public/" or similar. That one is meant to be used as document root. You only have to ensure there are no sensitive files in there . If you fail to introduce such a directory, you'll have a ga…

Great point. How much do you want to bet most of these are PHP, where it takes special discipline not to make your top directory web-accessible?

It takes very little effort in php. You simply have your index.php and any public assets in the document root and then use index.php as a bootstrap to bring up your application. Everything else goes outside of the document root.

Re: One in every 600 websites has .git exposed

#173

Post by twistedpair » Mon, Jul 27, 2015, 12:28 PM UTC

thaumaturgy wrote: post #76

morninj wrote: post #36

Earlier quoted context omitted.

Better yet: $ rm -rf .git/ It's way safer to delete the repo history from the production server than to rely on Apache rules copied from a forum.

Better better yet, don't use git to move code from test to prod. Use rsync, and exclude .git and other nuisance files. Unfortunately I can't seem to convince anyone that this is good practice. :-(

Amen. Don't use git to deploy code. Use it to version code. Use a script on your CI to compile/test/minify/convert your code into a deployable tar ball and stick that somewhere highly durable like S3, Swift, or your own company filestore.

Remember, git providers go down (i.e. DDOS to GitHub or internal fail at BitBucket). Don't depend on git being up to deploy your code or you'll look like a fool next time a DDOS at GH coincides with a deployment.

Re: One in every 600 websites has .git exposed

#174

Post by jsjohnst » Mon, Jul 27, 2015, 12:28 PM UTC

tokenizerrr wrote: post #156

jsjohnst wrote: post #120

Earlier quoted context omitted.

Glad I don't work at your shop then. Environment variables are a terrible way to give your app secure information. There's well over a dozen reasons why you shouldn't do this in your apps, but one super obvious one is there's way to many frameworks that expose environment variables in their debug output if not properly configured. Think you'll never misconfigure a server? Guess again, pretty much every major site (Go…

Please review HN's guidelines on civility.

Fair point, I potentially should've left off the first sentence. I stand behind the rest of the post, but the first sentence is a bit on the edge and I apologize.

Re: One in every 600 websites has .git exposed

#175

Post by tokenizerrr » Mon, Jul 27, 2015, 12:32 PM UTC

jsjohnst wrote: post #174

tokenizerrr wrote: post #156

Earlier quoted context omitted.

Please review HN's guidelines on civility.

Fair point, I potentially should've left off the first sentence. I stand behind the rest of the post, but the first sentence is a bit on the edge and I apologize.

Alright, well, I've never seen an application/framework spit out environment variables when it was misconfigured. But then again, I barely work with web-related stuff so maybe I just don't use the kind of software that does this. Could you provide some examples?

Re: One in every 600 websites has .git exposed

#176

Post by samuellb » Mon, Jul 27, 2015, 12:59 PM UTC

realityking wrote: post #150

aikah wrote: post #140

It's clear the problem involves some PHP sites developed with git and instead of using a specific www directory inside the project the server points to the root folder of the project thus exposing .git (and the rest). Classic dumb error by PHP developers. I have hard time believing one would be able to expose the .git folder in a Rails,Spring or Django application since the public folder isn't the root folder of the…

Excluding anything that starts with a period also doesn't work - RFC 5785 specs the folder .well-known with special meaning.

True, but you can whitelist /.well-known/. I don't think anything else uses dot-filenames in URLs, because not all operating systems and software even allow such file names (for instance, the file browser in Windows forbids it when creating a new file or folder).

Re: One in every 600 websites has .git exposed

#177

Post by lsaferite » Mon, Jul 27, 2015, 1:06 PM UTC

juliangregorian wrote: post #124

x0 wrote: post #121

Earlier quoted context omitted.

I've had more success with 'intitle: Index of /.git'

Yep. Try this one: https://www.google.com/search?q=intitle:%22Index+of+%2F.git%...

So google doesn't like me after doing that search.

I suddenly started getting a captcha for searches right after using that search. o_O

Re: One in every 600 websites has .git exposed

#178

Post by emmelaich » Mon, Jul 27, 2015, 1:23 PM UTC

git (and hg and svn and tar and cpio and pax and zip and ...) should set the permission of the archive (vcs db) to the most restrictive of the permissions of those added.

Also ... webservers should make it very hard to offer up .dotfiles as webcontent.

Re: One in every 600 websites has .git exposed

#179

Post by emmelaich » Mon, Jul 27, 2015, 1:29 PM UTC

dangero wrote: post #68

Dylan16807 wrote: post #57

Earlier quoted context omitted.

Wrong lesson. Don't put secret keys in your repository. Someone getting a copy of your code should be a big annoyance at worst.

Where is the right place to store db passwords, api keys, etc? What is best practice in this area?

I think that if you're using git,

    use git crypt[1][2]
    use git-dir and work-tree options/env vars

[1] https://www.agwa.name/projects/git-crypt/

[2] though you have to remember to git crypt lock

Re: One in every 600 websites has .git exposed

#180

Post by damon_c » Mon, Jul 27, 2015, 1:36 PM UTC

tokenizerrr wrote: post #175

jsjohnst wrote: post #174

Earlier quoted context omitted.

Fair point, I potentially should've left off the first sentence. I stand behind the rest of the post, but the first sentence is a bit on the edge and I apologize.

Alright, well, I've never seen an application/framework spit out environment variables when it was misconfigured. But then again, I barely work with web-related stuff so maybe I just don't use the kind of software that does this. Could you provide some examples?

Many web frameworks do this when in "debug" mode.