0

I have an older Laravel 5.7 project handed to me. Laravel's current version is 8. I don't know if these details are relevant to my problem, but I'm adding them anyway. I have a test server running off an IP address (no domain) for the clients to see the progress as I push new features to GitHub. This GitHub project is set as private and the server is properly configured to only show the public folder. The private repo also does not have a hard coded .env file, so even if someone was to get into my GitHub, he would not be able to get any real information from the .env file, as it is blank and is configured directly on the server.

To my main issue. I am using Mailtrap for testing purposes and I keep getting unauthorized mail like this: Screenshot Of Email

I have tried deleting my Mailtrap mailbox and recreating it to get new credentials, but some random script kiddie always happens to crack the SMTP server. At the moment, since my SMTP is connected to Mailtrap, this is harmless. But when I get the real website online, I'm worried about how these crackers are doing this.

Any ideas?

Improve this question
6
  • Have you considered instead that someone has actually cracked the Laravel project and is sending spam through it?
    – Michael Hampton
    Dec 17, 2020 at 23:31
  • I'm new to Laravel, so I'm not sure what "cracked the Laravel project" means. Could you give a bit more detail? Thanks for the help!
    – Daemonleak
    Dec 17, 2020 at 23:42
  • Cracked means: Found a security hole in it and exploited it.
    – Michael Hampton
    Dec 17, 2020 at 23:47
  • Yes, I know. I thought you meant something specifically about encryption when you said cracked. Miscommunication I guess.
    – Daemonleak
    Dec 17, 2020 at 23:50
  • 1
    You probably should get someone else you trust to review the application code.
    – Moshe Katz
    Dec 17, 2020 at 23:53

1 Answer 1

Reset to default
0

The main reasons this can happen are:

  • Your production website is APP_DEBUG=true

Change the setting in your .env to false for debug mode, otherwise your app details are visible if anyone can get your site to display an error page.

  • Your website is configured incorrectly and .env is visible

Try visiting yourwebsite.com/.env or your.ip.add.ress/.env and see if you can view your .env files

  • You have installed Laravel into a sub-directory, meaning your site files are visible
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.