4 ms·
After reading your post, I thought "these things happen; they'll figure it out with experience." Tried going to clientsite.com/api/.env on a whim, and leapt ou
by tortasaur 7y ago
After reading your post, I thought "these things happen; they'll figure it out with experience."
Tried going to clientsite.com/api/.env on a whim, and leapt out of bed.
- redstripe 7y agoBots also regularly check for .git in common folders: 404 - GET /admin/.git/config 404 - GET /shop/.git/config 404 - GET /beta/.git/config etc.. or adhoc backups using the current date -- stuff that you think nobody would even try. 404 - GET /2020-02-27.zip 404 - GET /backup20200227.zip 404 - GET /backup.zip etc... No webserver should be serving .folders in it's default config.