Exposed Source Code

Introduction

Source code intended to be kept server-side can sometimes end up being disclosed to users. Such code may contain sensitive information such as database passwords and secret keys, which may help malicious users formulate attacks against the application.

How to Find

1. Exposed Git folder

https://site.com/.git

2. Exposed Subversion folder

https://site.com/.svn

3. Exposed Mercurial folder

https://site.com/.hg

4. Exposed Bazaar folder

http://target.com/.bzr

5. Exposed Darcs folder

http://target.com/_darcs

6. Exposed Bitkeeper folder

http://target.com/Bitkeeper

Reference:

• NakanoSec (my own post)