Exposed .git Folder: Scanning the Web for Secrets

Overnight, a public web server started handing out the contents of its hidden version-control folder to anyone who asked. Before you triage, orient yourself on how a single exposed file turns into a full cloud-account takeover.

The scanner walked a list of hidden file paths looking for one the server would actually return. Most came back as not-found. Find the single path the server served instead, opening the whole chain.

The file the server handed over was tiny, but it leaked something valuable: a repository clone URL with a developer's access token embedded in it. Identify the account whose token was exposed.

The scanner that pulled that file was not the same machine that used the token. A different external address validated the credential and cloned the private repository. Identify it.

Cloning the repo was not the prize. The attacker grepped the source for a hard-coded cloud key and found one that was still live. Identify the AWS access key that was used against the account.

With administrative access to the cloud account, the attacker created a new user to keep sending spam through the company's infrastructure. Priya needs the exact name to delete it. Identify the rogue IAM user.

Step back and label the heart of this incident. The attacker never exploited a software bug. They simply read a credential out of a file that was sitting in the open. Map that to MITRE ATT&CK.