Two thousand guesses for one file
In one week the web honeypot logged five thousand three hundred and sixty requests hunting for an environment file, spread across two thousand one hundred and eleven distinct paths. The scanner does not know which framework is running, so it walks every layout it has ever seen - the plain path, the stale backup, the production copy, the framework subdirectory. It costs nothing to guess wrong and everything to guess right, because that one file usually holds database passwords and API keys in plain text.
Two thousand one hundred and eleven different paths this week, all hunting the same one file.
The environment file holds a project’s database password and its keys, in plain text, because it was never meant to be reachable.
Five thousand three hundred and sixty requests went looking for it in one week. Sorted by path, the strategy is obvious.
The plain one at the top. Then the stale backup somebody renamed instead of deleting. The production copy. The development copy. Then the same file again under the folder each framework uses.
The scanner has no idea what you run. It does not need to. It walks every layout it has seen, and wrong guesses cost nothing.
Being unusual is not cover. The list is not aimed at you; it is aimed at everyone, and you are on it by having an address.
Keep secrets out of the web root, not just out of git.
#linux#security#selfhosted#infosec#webdev
❯ Keep secrets out of the web root, not just out of git.