Level 2 · 2B Exposed files · Lesson 1 of 2
Which files must never be public
A website is a folder of files on a server. Anything inside the public part can be downloaded by anyone who knows (or guesses) its name. And guessing is easy: there are programs that try thousands of common names per minute.
The ones that do the most damage
The .env file stores the app's keys and secret data. The .git folder stores the entire history of the code, old versions included. Database copies (.sql, .bak) contain all the customers' data. Customer spreadsheets are a leak of personal data. And credential files open the doors to the cloud.
Another problem is folder listing: if the server is badly configured, it shows an "Index of /archivos/" page with a list of everything inside. It's like leaving the door open with the inventory taped to the shop window.
Going deeper
Look without touching
curl -I https://TU-SITIO.com/.env
curl -I https://TU-SITIO.com/.git/config- With curl -I you ask only for the response headers, without downloading anything. Replace TU-SITIO.com ("your site") with your own site's address.
- If you see 404 (not found) or 403 (forbidden), good. If you see 200, open it (curl https://TU-SITIO.com/.env | head) and check whether it's really the file or just your home page: some sites answer 200 to everything. If it's the file, it's exposed and you have to take it down right away.
- Do this ONLY with your own sites. Probing for files on other people's sites without permission is not a game.
Review questions
A file named ".env" usually holds...
Answer: The app's keys and secret data. With those keys someone can get into the database, the email or the payments. It must never be in the public folder.
The robots.txt file asks search engines not to go into /privado/ (a "private" folder). Does that protect the folder?
Answer: No: it's only a request, anyone can still get in. robots.txt is a "please keep out" sign, not a lock. In fact, it tells people there's something there.
A server shows "Index of /archivos/" with a list of every file. What's the problem?
Answer: An exposed folder listing: it shows what's there to download. It hands the attacker the inventory. You turn it off in the server settings, and private things shouldn't be there anyway.