Mike Sheward on Nostr: I do love a good “comedy of errors” pen testing finding. And here is what I mean ...

I do love a good “comedy of errors” pen testing finding. And here is what I mean by that, very recent example (last week):

During OSINT discover target app was previously worked on by third party dev shop.

Find public repo belonging to former employee of third party dev shop on Github, contains a lot of juicy info about app, but no hardcoded creds or secrets.

Check commit history.

Commit called - “remove creds and secrets”.

There they are, in the history.

But wait, this file has a lot of commit history.

Oh cool, creds and secrets from the previous customer this dev shop worked for, and accidentally copied over into a template .env.

And scene.

The two things that remember: pepperidge farm and git commit history

#infosec