$ cat index.html
....
<script>
function login() {
let form = document.getElementById("login-form");
console.log(form.elements);
let username = form.elements["username"].value;
let password = form.elements["password"].value;
if (
username === "admin" &&
password === "{{REDACTED}}"
) {
document.cookie = "login=1";
window.location.href = "/dashboard.html";
} else {
document.getElementById("error").innerHTML =
"INVALID USERNAME OR PASSWORD!";
}
}
</script>
</body>
</html>
We've found hard coded password in index.html page. Submit password as flag.
Real World Analogy
Conclusion
That was FUN!!
If you're gonna hard code credentials on client side, there is always someone who's gonna break the code.
.git directory shouldn't be accessible to anyone. A minor server misconfiguration will allow attacker to find attack vector and exploit your infra/apps.
From one of the open source project. The developers mistakenly commited paid services code block on their community edition git repo. I was able to reverse engineer the code block and avail those premium services by making changes to the community edition codebase.
