Answer:

2. File That Leaked the Database

• Checked git history: 

    git log --all --oneline
  

• Found "Remove backup scripts" commit
• Examined deleted files: 

    git show --name-status 1cc71b0
  

• Restored the deleted file: 

    git show '1cc71b0^:app/util/backup_db.py'
  

• The file revealed it uploads database backups to S3, encoded only with ROT13

Answer:

3. Naomi Adler's Password Hash

• From backup_db.py, identified S3 location: s3://protoguard-asset-management/db_backup.xyz

• Downloaded the publicly accessible backup:

    aws s3 cp s3://protoguard-asset-management/db_backup.xyz /tmp/db_backup.xyz --no-sign-request
  

• Decoded ROT13 encoding using Python: codecs.decode(data, 'rot_13')

• Searched for Naomi:

    grep -i "naomi" /tmp/db_backup_decoded.sql
  

Answer:

4. Public Address of Database Leak

Extracted from backup_db.py configuration (lines 20-22):

• S3_BUCKET: protoguard-asset-management
• S3_KEY: db_backup.xyz
• S3_REGION: us-east-2
• Constructed public S3 URL format: https://{bucket}.s3.{region}.amazonaws.com/{key}

Answer:

Notes

The breach occurred due to multiple security failures:

• Sensitive backup script committed to git (permanent history even after deletion)
• ROT13 used instead of real encryption
• S3 bucket publicly accessible without authentication
• Database credentials hardcoded in source code