insecure-source-code-management
starsforks
How to install insecure-source-code-management?
prohao42/aimy-skill/insecure-source-code-management
$npx -y skills add Prohao42/aimy-skill --skill insecure-source-code-management--- name: insecure-source-code-management description: >- Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing. ---
SKILL.md
| 1 | # SKILL: Insecure Source Code Management |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: This skill covers detection and recovery of exposed version-control metadata, common backup artifacts, and related misconfigurations. Use only in **authorized** assessments. Treat recovered credentials and URLs as sensitive; do not exfiltrate real data beyond scope. For broad discovery workflow, cross-load [recon-for-sec](../recon-for-sec/SKILL.md) and [recon-and-methodology](../recon-and-methodology/SKILL.md) when those skills exist in the workspace. |
| 4 | |
| 5 | ## 0. QUICK START |
| 6 | |
| 7 | High-value paths to probe first (GET or HEAD, respect rate limits): |
| 8 | |
| 9 | ```http |
| 10 | /.git/HEAD |
| 11 | /.git/config |
| 12 | /.svn/entries |
| 13 | /.svn/wc.db |
| 14 | /.hg/requires |
| 15 | /.bzr/README |
| 16 | /.DS_Store |
| 17 | /.env |
| 18 | ``` |
| 19 | |
| 20 | **Routing note**: quickly probe these paths first; for full recon workflow, load methodology from `recon-for-sec` and `recon-and-methodology` before deeper testing. |
| 21 | |
| 22 | --- |
| 23 | |
| 24 | ## 1. GIT EXPOSURE |
| 25 | |
| 26 | ### Detection |
| 27 | |
| 28 | - **`/.git/HEAD`** — valid repo often returns plain text like: |
| 29 | |
| 30 | ```text |
| 31 | ref: refs/heads/main |
| 32 | ``` |
| 33 | |
| 34 | - **`/.git/config`** — may expose `remote.origin.url`, user identity, or embedded credentials. |
| 35 | - **`/.git/index`**, **`/.git/objects/`** — partial object store access enables reconstruction with the right tools. |
| 36 | |
| 37 | ### 403 vs 404 |
| 38 | |
| 39 | - **`404`** — path likely absent or fully blocked at the edge. |
| 40 | - **`403` on `/.git/`** — directory may **exist** but listing is denied; still try direct file URLs: |
| 41 | |
| 42 | ```http |
| 43 | /.git/HEAD |
| 44 | /.git/config |
| 45 | /.git/logs/HEAD |
| 46 | /.git/refs/heads/main |
| 47 | ``` |
| 48 | |
| 49 | A **403 on the directory** plus **200 on `HEAD`** strongly indicates exposure. |
| 50 | |
| 51 | ### Recovery tools (open source) |
| 52 | |
| 53 | - **`arthaud/git-dumper`** — dumps reachable `.git` tree when individual files are fetchable. |
| 54 | - **`internetwache/GitTools`** — Dumper, Extractor, Finder modules for partial/corrupt dumps. |
| 55 | - **`WangYihang/GitHacker`** — alternative recovery when standard dumpers miss edge cases. |
| 56 | |
| 57 | ### Key files to prioritize |
| 58 | |
| 59 | | Path | Why it matters | |
| 60 | |------|----------------| |
| 61 | | `.git/config` | Remotes, credentials, hooks paths | |
| 62 | | `.git/logs/HEAD` | Commit history, reflog-style leakage | |
| 63 | | `.git/refs/heads/*` | Branch tips, commit SHAs | |
| 64 | | `.git/packed-refs` | Packed branch/tag refs | |
| 65 | | `.git/objects/**` | Object blobs for reconstruction | |
| 66 | |
| 67 | --- |
| 68 | |
| 69 | ## 2. SVN EXPOSURE |
| 70 | |
| 71 | ### Detection |
| 72 | |
| 73 | - **SVN before 1.7**: **`/.svn/entries`** — XML or text metadata listing paths and revisions. |
| 74 | - **SVN ≥ 1.7**: **`/.svn/wc.db`** — SQLite working copy database (`PRAGMA table_info` after download). |
| 75 | |
| 76 | Example probe: |
| 77 | |
| 78 | ```http |
| 79 | GET /.svn/entries HTTP/1.1 |
| 80 | GET /.svn/wc.db HTTP/1.1 |
| 81 | ``` |
| 82 | |
| 83 | ### Recovery |
| 84 | |
| 85 | - **`anantshri/svn-extractor`** — automated extraction from exposed `.svn`. |
| 86 | - **Manual**: download `wc.db`, query with `sqlite3` for file paths and checksums, then request **`/.svn/pristine/`** blobs if exposed. |
| 87 | |
| 88 | --- |
| 89 | |
| 90 | ## 3. MERCURIAL EXPOSURE |
| 91 | |
| 92 | ### Detection |
| 93 | |
| 94 | - **`/.hg/requires`** — small text file listing repository features; confirms Mercurial metadata. |
| 95 | |
| 96 | ```http |
| 97 | GET /.hg/requires HTTP/1.1 |
| 98 | GET /.hg/store/ HTTP/1.1 |
| 99 | ``` |
| 100 | |
| 101 | ### Recovery |
| 102 | |
| 103 | - **`sahildhar/mercurial_source_code_dumper`** — dumps repository when store paths are reachable. |
| 104 | |
| 105 | --- |
| 106 | |
| 107 | ## 4. OTHER LEAKS |
| 108 | |
| 109 | ### Bazaar (Bzr) |
| 110 | |
| 111 | - Probe **`/.bzr/README`** and **`/.bzr/branch-format`** for Bazaar metadata. |
| 112 | |
| 113 | ### macOS `.DS_Store` |
| 114 | |
| 115 | - **`/.DS_Store`** can encode directory and filename listings. |
| 116 | - Tools: **`gehaxelt/ds-store`**, **`lijiejie/ds_store_exp`** — parse `.DS_Store` offline. |
| 117 | |
| 118 | ### Backup and config artifacts |
| 119 | |
| 120 | Probe (adjust for app root and naming conventions): |
| 121 | |
| 122 | ```text |
| 123 | /.env |
| 124 | /backup.zip |
| 125 | /backup.tar.gz |
| 126 | /wwwroot.rar |
| 127 | /backup.sql |
| 128 | /config.php.bak |
| 129 | /.config.php.swp |
| 130 | ``` |
| 131 | |
| 132 | ### Web server misconfiguration signal (example: NGINX) |
| 133 | |
| 134 | - **`location /.git { deny all; }`** — may return **403** for `/.git/` while still allowing or denying specific subpaths depending on rules. |
| 135 | - **403 on a protected location** can **confirm the route exists**; always distinguish from **404** on non-existent paths. |
| 136 | |
| 137 | --- |
| 138 | |
| 139 | ## 5. DECISION TREE |
| 140 | |
| 141 | 1. **Probe `/.git/HEAD`** → `ref: refs/heads/` pattern? → run **git-dumper / GitTools / GitHacker**; review `config` and `logs/HEAD` for secrets. |
| 142 | 2. **Else probe `/.svn/wc.db` or `entries`** → success? → **svn-extractor** or manual `wc.db` + pristine recovery. |
| 143 | 3. **Else probe `/.hg/requires`** → success? → **mercurial dumper**. |
| 144 | 4. **Else probe `/.bzr/README`** → Bazaar tooling or manual path walk. |
| 145 | 5. **Parallel**: fetch **`/.DS_Store`**, **`/.env`**, common **backup extensions** on app root and parent paths. |
| 146 | 6. **Interpret status codes**: **403 on directory** + **200 on specific files** → treat as **high priority** for file-by-file extraction. |
| 147 | |
| 148 | --- |
| 149 | |
| 150 | ## |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
