CrowdSecC
CrowdSecβ€’7mo ago
thatwhiff

git-dumper requests not being blocked despite sensitive-files scenario

Hi all,

I'm having the CrowdSec + nginx bouncer setup on a server with a publicly accessible 
.git/
 directory. I'm using 
git-dumper
 to simulate exploitation, but CrowdSec isn't blocking the requests.

The nginx logs are correctly parsed and enriched (
cscli explain
 confirms this).
The sensitive-files scenario 
crowdsecurity/http-sensitive-files
) is installed.
git-dumper
 hits look like this:

x.x.x.x - - [06/Jun/2025:03:08:36 -0700] "GET https://example.com/.git/hooks/pre-commit.sample HTTP/1.1" 200 1643 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"


cscli explain
 shows only the 
http-crawl-non_statics
 scenario matched, not 
http-sensitive-files
.
β”œ s00-raw
| β”œ πŸ”΄ crowdsecurity/syslog-logs
| β”” 🟒 crowdsecurity/non-syslog (+5 ~8)
β”œ s01-parse
| β”” 🟒 crowdsecurity/nginx-logs (+23 ~2)
β”œ s02-enrich
| β”œ 🟒 crowdsecurity/dateparse-enrich (+2 ~2)
| β”œ 🟒 crowdsecurity/geoip-enrich (+13)
| β”œ 🟒 crowdsecurity/http-logs (+7)
| β”œ 🟒 custom/whitelists (unchanged)
| β”” 🟒 crowdsecurity/whitelists (unchanged)
β”œ-------- parser success 🟒
β”œ Scenarios
β”” 🟒 crowdsecurity/http-crawl-non_statics


What could I be missing here? Do I need to customize the pattern list in the scenario? Or is this not covered by default?

Thanks!
Was this page helpful?