CrowdSec•3mo ago

git-dumper requests not being blocked despite sensitive-files scenario

Hi all, I'm having the CrowdSec + nginx bouncer setup on a server with a publicly accessible .git/ directory. I'm using git-dumper to simulate exploitation, but CrowdSec isn't blocking the requests. The nginx logs are correctly parsed and enriched (cscli explain confirms this). The sensitive-files scenario crowdsecurity/http-sensitive-files) is installed. git-dumper hits look like this:

x.x.x.x - - [06/Jun/2025:03:08:36 -0700] "GET https://example.com/.git/hooks/pre-commit.sample HTTP/1.1" 200 1643 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"

x.x.x.x - - [06/Jun/2025:03:08:36 -0700] "GET https://example.com/.git/hooks/pre-commit.sample HTTP/1.1" 200 1643 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"

cscli explain shows only the http-crawl-non_statics scenario matched, not http-sensitive-files. ├ s00-raw | ├ 🔴 crowdsecurity/syslog-logs | └ 🟢 crowdsecurity/non-syslog (+5 ~8) ├ s01-parse | └ 🟢 crowdsecurity/nginx-logs (+23 ~2) ├ s02-enrich | ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2) | ├ 🟢 crowdsecurity/geoip-enrich (+13) | ├ 🟢 crowdsecurity/http-logs (+7) | ├ 🟢 custom/whitelists (unchanged) | └ 🟢 crowdsecurity/whitelists (unchanged) ├-------- parser success 🟢 ├ Scenarios └ 🟢 crowdsecurity/http-crawl-non_statics What could I be missing here? Do I need to customize the pattern list in the scenario? Or is this not covered by default? Thanks!

4 Replies

CrowdSec•3mo ago

Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve

iiamloz•3mo ago

The sensitive files is very limited and only looks for specific git files rather than a directory, imo yes crowdsec can detect these but it better to simply block all requests to dot files within a nginx configuration such as:

# . files
location ~ /\.(?!well-known) {
    deny all;
}

# . files
location ~ /\.(?!well-known) {
    deny all;
}

Then CrowdSec doesnt need to be reactive and your web server configuration is proactively stopping all requests to .env and .git by default.

thatwhiffOP•3mo ago

Got it Thanks

CrowdSec•3mo ago

Resolving git-dumper requests not being blocked despite sensitive-files scenario This has now been resolved. If you think this is a mistake please run /unresolve

Gaming

Programming

git-dumper requests not being blocked despite sensitive-files scenario

Did you find this page helpful?