Level 54
@vladv how did you end up with public .env files? .env should be 1 directory up and outside of /public
Nov 2, 2020
13
Level 12
SMTP CRACK/HACK
One of my websites got "hacked", mailtrap credentials got compromised. They send some emails with the subject "LARAVEL SMTP CRACK | HOST: smtp.mailtrap.io".
After searching a little I have a tool called "LARAVEL SMTP CRACK". I wonder how it works, I assume it scans for pubic .env files or it hits a URL in order to throw an exception and if the project has APP_DEBUG set to true if will throw all data from the .env file.
Has anybody got also into this issue/mistake? Can be another way in order to access .env data?
Level 12
@automica I didn't, my mistake was to forget APP_DEBUG=true for a while (I hope).
Level 54
@vladv so not switching your live instance to production then?
Level 12
@automica yup
Level 122
and also forgetting to replace mailtrap credentials for production ones?
Level 80
@vladv It’s better to find out how someone managed to got your Mailtrap credentials. If someone’s gotten your Mailtrap credentials then you should consider all API keys and passwords compromised, and change them.
1 like
Level 12
@snapey actually is an online (live) development environment (I know that not the right way, but it's for the client), and happens sometimes that a needed to set APP_DEBUG= true in order to do a quick fix with live data (I know this is not how the thinks should be made).
Level 54
@vladv best to hide dev sites under a .htaccess and then you will be able to keep site in debug mode and away from public
1 like
Level 80
It’s amazing how many developers know how not to do things… yet do them any way?
Level 12
@martinbean yes, but you know in a project, most of a time, there are many compromises made in order to satisfy all involved
Level 80
@vladv Yes. And if you’re going to form habits, then it’s better to form good ones than bad ones.
Level 1
this is currently happening to me, is there a way you can email me this tool, so i can be sure that it is real and does what everything claims it does, and potentially figure out a way to fix this issue i dont see a way to PM the OP. OP if you can PM me i can give you my email and if you would send me this tool that would be a HUGE help!
Thanks
Level 12
@michealm there is no PM option, but you can search on youtube for SMTP CRACK Laravel by xcatze
Please or to participate in this conversation.