The .env file is public

A Laravel app’s web root points at the project folder instead of public/. Find the misconfigured root, which secrets the .env file exposes, and how many times scanners fetched it.

Terminal mission
Beginner
3 objectives
0 of 3 solved

Briefing

Frameworks such as Laravel keep secrets in a .env file in the project root and serve only the public/ subfolder. If the web server’s root points at the project root, /.env is just another static file.

Scanners request /.env on every host on the internet within hours of it appearing.

analyst@help-01

help-01 · Web config review

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@help-01:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.