Description

The cloned repository contains a README with the password redacted. The password was present in an earlier commit before it was removed. The goal is to find it in the git history.

Overview

• git log shows commit history; git show <hash> shows the diff introduced by a commit.
• A commit that removes or replaces a password line will show it in the diff with a - prefix.

Solution

cd /tmp/work && git clone ssh://bandit28-git@localhost:2220/home/bandit28-git/repo
cd repo
git log --oneline
git show <hash of "fix info leak" commit>

• The diff shows - password: <actual password> before it was redacted.

Password

tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8S