One in every 600 websites has .git exposed

Re:One in every 600 websites has .git exposed by ejcx on Sunday July 26, 2015 @09:52PM (#9952977)

I did a conference talk at derbycon on exactly this, regarding startups. The amount of obvious holes of founders not knowing what XSS is, or writing bad PHP apps with obvious code execution vulns, or glaring logic and auth mistakes allowing full account hijacks is incredible.

It's really bad out in AppSec land

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by tracker1 on Monday July 27, 2015 @12:42AM (#9953384)

Hell, I recently saw an application where there was unchecked input for being able to download files outside the application... if you passed it a path of, for example `../../somefoo-file` would take you out of that application's path.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by ejcx on Monday July 27, 2015 @01:11AM (#9953451)

This is called either a Local File Inclusion or a Directory Traversal Vulnerability. The name depends on the details. It's really really common, and definitely something I see a lot of.

The OWASP Top 10 is deadly.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by RowanH on Sunday July 26, 2015 @10:49PM (#9953091)

Link to your talk ?

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by ejcx on Sunday July 26, 2015 @10:55PM (#9953098)

It was my first conference talk. If you would like to ask any questions email me at the one in my profile

https://m.youtube.com/watch?v=wzrVYyouQTk

[ Parent | on HN ]