NetSPI Blog

Parsing SVN Entries Files with PowerShell

Karl Fosaaen
August 20th, 2013

Frequently during external and web application penetration tests, we run into SVN entries files on web servers. These files are sometimes created as part of the SVN commit process and can lead to the disclosure of files (and source-code) that has been added to the web directory. This can be especially impactful for assessments, where there may be vulnerable pages (and/or configuration files) that are not clearly advertised from the main web site (i.e.: admin_backdoor.jsp or web.config).

The files are typically laid out in lists of files and directories followed by their type (dir, file) on the next line.

registry
dir

admin_login.jsp
file

Additionally, there may be source files accessible through the svn-base files (i.e.: /.svn/text-base/ExamplePage.jsp.svn-base). You can consider these files like backups of the originals that (hopefully) won’t execute on the server. Sometimes, the server sees these files with their original extension (.jsp) and you may have trouble getting at the source.

The entries files can typically be found in each directory that is used by SVN, as well as any subdirectories. So if a directory shows up in your entries list, it’s worth looking in that directory for another entries file. I got tired of manually going through each of these entries files, so I wrote a script to automate listing the files, source files, and directories into an HTML file. The script also goes into each identified directory to find more entries files to spider.

Script Usage:

SVNtoDIR   http://somewebsite.com/DIR/.svn/entries  SVNbaseDIR (optional)

Output:

The script will output a directory named after the directory that you’re starting in (i.e.: DIR), and in that directory will be an HTML file (DIR.html) that you can use to start navigating files. Links to the svn-base files are included on the page and show up with the .svn-base file extension. If you are familiar with the default Apache directory listing page, this should be pretty easy for you to navigate. I’ve also added sorting for the table, just click on Name or Type at the top.

Additionally, I’ve added an option for a second parameter that you can use for outputting the .svn-base files to a directory. Be careful with this one, as you can potentially end up downloading the entire web root.

The script is available out at the NetSPI GitHub – https://github.com/NetSPI/SVNentriesParser

4
Leave a Reply

avatar
4 Comment threads
0 Thread replies
0 Followers
 
Most reacted comment
Hottest comment thread
0 Comment authors
John Kanant shrivastavaBg44KireyNed Recent comment authors

This site uses Akismet to reduce spam. Learn how your comment data is processed.

  Subscribe  
newest oldest most voted
Notify of
Ned
Guest
Ned

This is pretty cool. SVN can be a pain, but we have to work with it.

Bg44Kirey
Guest
Bg44Kirey

Good advice, I often forget about SVN files!

anant shrivastava
Guest

Cool work, I did something simmilar with python https://github.com/anantshri/svn-extractor few months back.

but i agree html layout eases out the work.

John K
Guest
John K

Ha, SVN. Good script!