Bandit 30 → 31

OverTheWire Linux Progressive

Goal: find the password attached to a tag in the repository, not to any commit on a branch.

Approach

bandit30@bandit

bandit30@bandit:~$ cd "$(mktemp -d)" && git clone ssh://bandit30-git@localhost:2220/home/bandit30-git/repo
bandit30@bandit:...$ cd repo
bandit30@bandit:...$ cat README.md
just an epmty file... muahaha
bandit30@bandit:...$ git tag
secret
bandit30@bandit:...$ git show secret
The password you are looking for is: <password>

Passwordfb5S2xb7bRyFmAvQYQGEqsbhVyJqhnDyReveal

Why it works

A Git tag serves as a static, named reference to a specific object, separated from the commit and branch graph, so its contents never show up in a normal log or checkout. git tag lists it and git show secret prints what it points at, here the password.