OSCP Reference

9.4.4 File and Repository Hunting

← Stage index | HTTP mapping | Credential handling | Strategy map | Study methods: Map useful web behavior; Escalate privileges on Linux; Escalate privileges on Windows

9.4.4.1 Determine whether exposed repository metadata reveals source Exposed Git metadata

curl -ski http://TARGET:PORT/.git/HEAD
curl -ski http://TARGET:PORT/.git/config

A readable HEAD/config supports exposed repository metadata. A 403, redirect or generic template is not proof. Preserve the correct host header/base path.

If authorized, recover into a new local directory with a purpose-built tool and inspect locally:

git-dumper http://TARGET:PORT/.git/ repo-output
git -C repo-output status
git -C repo-output log --oneline --all --decorate
git -C repo-output log -p --all

git-dumper is an optional third-party helper; install on demand in an isolated environment only when the exposure has been confirmed. Manual object recovery is possible but slower.

rg -ni 'password|passwd|token|secret|api[_-]?key|private[_-]?key' repo-output
git -C repo-output log --all -S'password' --oneline
git -C repo-output log --all -G'pass(word)?|secret|token' --oneline

Inspect candidate commits without dumping all history:

git -C repo-output show COMMIT -- PATH
git -C repo-output diff COMMIT^ COMMIT -- PATH

Validate freshness, identity and compatible use. Removed historical values are often rotated or environment-specific.

9.4.4.3 Find useful files within accessible Linux locations Linux scoped file hunting

find /home /var/www /opt /srv -type f \
  \( -iname '*.conf' -o -iname '*.ini' -o -iname '*.env' -o -iname '*.bak' \
     -o -iname '*.old' -o -iname '*.key' -o -iname '*.pem' \) 2>/dev/null

rg -ni 'password|passwd|token|secret|api[_-]?key|connection(string)?' \
  /var/www /opt /srv 2>/dev/null

9.4.4.4 Find useful files within accessible Windows locations Windows scoped file hunting

Get-ChildItem C:\Users,C:\ProgramData,C:\inetpub -File -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'pass|cred|config|backup|unattend|\.env' }

Get-ChildItem C:\Users,C:\ProgramData,C:\inetpub -File -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.config','.xml','.ini','.txt','.ps1','.bat','.cmd' } |
  Select-String -Pattern 'password|passwd|secret|token|connectionString' -CaseSensitive:$false

Avoid searching the entire filesystem without a reason; scope reduces noise, access errors and sensitive-data overcollection.

9.4.4.5 Exposed .git — recover source and old configuration

Use after a real .git/HEAD response, not a generic 200/default page. GitTools can recover accessible objects even when directory listing is disabled; missing objects can still leave an incomplete repository.

9.4.4.5.1 curl -i http://TARGET:PORT/.git/HEAD

curl -i http://TARGET:PORT/.git/HEAD
bash GitTools/Dumper/gitdumper.sh http://TARGET:PORT/.git/ recovered-git/
bash GitTools/Extractor/extractor.sh recovered-git/ recovered-files/

9.4.4.5.2 Inspect recovered history and a specific revision; do not run recovered code

# Inspect recovered history and a specific revision; do not run recovered code
git -C recovered-git log --all --oneline
git -C recovered-git show COMMIT:PATH/TO/FILE

Read: connection strings, routes, secret-handling code and removed credentials can identify the next request or account to test. Verify a recovered value in its actual context. A repository skeleton or one HEAD file does not prove complete recovery; inspect extractor output and errors before concluding that a file never existed.

Sources: upstream 1.

9.4.4.6 Sources

Top of document · Reference home