# ============================================================
# TEMUAN BARU — ROUND 2 DUMP .git (2026-08-25, sesi kedua)
# ============================================================

# --- F19 (BARU, HIGH) SEO Redirect Spam /kompromi tambahan: incu/ ---
# Path: /incu/index.php -> 301 Location: https://diklikaja.id/
#   (diklikaja.id TIDAK resolve saat ini — domain mati/hangus)
# Ada di git index: incu/.htaccess + incu/index.php
# Script = redirect 2 baris (header() di line 2 — konfirmasi via warning)
# Sama pola dgn kompromi lama: jitu/ (RPJITU) & images/berita/ (Paito HK)
# = redirect spam ketiga di server → konfirmasi akses tulis attacker berulang
# GET  -> 301 https://diklikaja.id/   (redirect)
# POST -> 200 553b warning deprecated (PHP 5.6, headers already sent)
# path absolut terkonfirmasi: /var/www/html/svlk/incu/index.php
# LFI include ../incu/index -> eksekusi (tidak bisa baca source via LFI)

# --- F20 (BARU, MEDIUM) Repo GitLab private terekspos via .git/config ---
# origin: https://gitlab.com/chyntia1204/svlk.git
# commit: 95c236c1a6ca46540b26a0bc8e149b7fcb67ceb8
# clone : Chyn <user@ISB-Chyntia-A-NB.local> tgl 2025-10-20 06:03 (epoch 1760940188)
#   -> konsisten dgn forensik staging massal 2025-10-20 (file jitu dll)
# Developer: "Chyn/Chyntia" (username gitlab: chyntia1204) — identitas developer
# API gitlab.com/api/v4/projects/chyntia1204%2Fsvlk -> 404 (repo PRIVATE, tak bisa diunduh)
# Web -> 302 (redirect login). Info disclosure: nama repo+owner+commit hash.
# Risiko: kalau kredensial gitlab developer bocor -> source code penuh.

# --- F21 (BARU, LOW) cgi-bin binaries ELF dapat diunduh ---
# /cgi-bin/cgiecho (23384b), /cgi-bin/cgiemail (23384b),
# /cgi-bin/entropybanner.cgi (4344b), /cgi-bin/randhtml.cgi (4336b)
# Semua ELF 64-bit stripped, nginx serve STATIS (POST -> 405, GET -> binary 200)
# cgiecho berisi string "CGIEmail is disabled on this system"
# Tidak executable via web (nginx bukan CGI handler) -> info disclosure minor
# + binary bisa dianalisis offline (cari creds) — belum ada temuan.

# --- F22 (BARU, LOW) dokumen/.htaccess terbaca publik (200, 145b) ---
# Isi: FilesMatch \.php$ Deny from all + Allow .htaccess (misconfig: file config terbaca)
# Konfirmasi aturan folder dokumen: .php diblokir, non-php disajikan statis
# (pdf dll dari dokumen/ bisa diunduh — konsisten F12)

# --- Lain-lain (cek, bukan temuan baru) ---
# indexold.php/indexnew.php/indexVersiKAN.php/loginform-administrator.php
#   = login page legacy (maintenance notice 2016) — sama seperti index.php
# test/ = folder dengan class.phpmailer/xFile/php_fast_cache (render 0b, kosong?)
# .DS_Store root (10244b) & nusoap (6148b) — bisa diunduh, format Bud1 aneh (tak terparse)
# 7px.php/pd.php/wp-sign.php/dokumen/Iogin.php/page/WiNK.php/xFile.phpygdipake
#   = file mencurigakan lama di index (sudah di-forensik sesi 1; sebagian tak ada di disk)
# incu/index.html -> fallback login (7414b)

# ============================================================
# STATUS: 4 temuan baru (1 HIGH, 1 MEDIUM, 2 LOW)
# RCE tetap: TIDAK (tidak ada vektor baru dari dump ini)
# ============================================================