Pwning an online retailer via public .git directory

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

A few days ago, I gained admin access to the ERP system of a German-based international online retailer 1 operating a number of e-commerce websites. The ERP system included sensitive employee data, customer data, and over 160k invoices. They quickly addressed the issues and the overall communication went very well. When I noticed that https://███████24.de/.git/config returned an actual git config…

Read on jomo.tv ↗