Description

The main branch of the repository has no password in production. The README says “no passwords in production!” which hints that another branch exists with the credentials.

Overview

• git branch -a lists all branches including remote ones.
• Checking out a development branch often reveals credentials committed before production hardening.

Solution

git clone ssh://bandit29-git@localhost:2220/home/bandit29-git/repo
cd repo
git branch -a
git checkout origin/dev
grep password README.md

Password

xbhV3HpNGlTIdnjUrdAlPzc2L6y9EOnS