Insecure Source Code Management Payloads & Testing Methodology
Exposing the version control system folders on a web server can lead to severe security risks, including:
Mercurial#
Mercurial (also known as hg from the chemical symbol for mercury) is a distributed version control system (DVCS) designed for efficiency and scalability. Developed by Matt Mackall and first released in 2005, Mercurial is known for its speed, simplicity, and ability to handle large codebases.
Summary#
Tools#
rip-hg.pl#
- kost/dvcs-ripper/master/rip-hg.pl - Rip web accessible (distributed) version control systems: SVN/GIT/HG...
powershell1 line
docker run --rm -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-hg.pl -v -u