FirstBlood-#760 — Multiple server config files are accessable publicly.
This issue was discovered on FirstBlood v2
On 2021-10-28, vishal Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
BugBountyHunter Membership
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Discription: multiple server configuration files are accessable to anyone.
Steps to Reproduce:
- visit /.gitattributes
- visit /.gitignore
- visit /composer.json
- visit /composer.lock
- visit /composer.phar
Impact : these are all either server files or config pages which are supposed to be kept private . information contained in these files could be used for further escilate attack by attacker like .composer.json reveal monolog version which is vulnerable to RCE.
Lastly let me know if anything missing or required - Vishal
P2 High
Endpoint: /.gitattributes /.gitignore /composer.json /composer.lock /composer.phar
Parameter: none
Payload: none
FirstBlood ID: 36
Vulnerability Type: Information leak/disclosure
It is possible to use the composer.json to aid with another vulnerability and gaining information/knowledge on versions used.