Lab: Information disclosure in version control history
Summary: This PortSwigger lab presents a web application that discloses sensitive information through its version control history. Solving it requires obtaining the administrator password from that history, logging in, and deleting the user carlos.
Why it matters: A version control directory left reachable on a production site hands over whatever was committed to it, including credentials like the administrator password in this lab, and that is enough for an attacker to log in and delete accounts.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026