Webserver URL Keyword Match for Source Code Enumeration via .git/ Paths

title: Webserver URL Keyword Match for Source Code Enumeration via .git/ Paths
id: 63850321-fd85-44dd-a21e-210f2a9948e0
status: test
description: This rule flags web requests whose URL strings contain the .git/ path marker, a common indicator of source code enumeration attempts against exposed version control directories. Attackers use these patterns to discover or retrieve repository contents and map application logic. The detection relies on webserver telemetry that records request URLs so the rule can match the keyword within the observed URL.
references:
  - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
  - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_source_code_enumeration.yml
author: James Ahearn, Huntrule Team
date: 2019-06-08
modified: 2022-10-05
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: webserver
detection:
  keywords:
    - .git/
  condition: keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 953d460b-f810-420a-97a2-cfca4c98e602
    type: derived