wufufu770 TL;DR
- 目的：Detect sensitive information leakage in web applications and APIs
- 适用：侦察阶段 + 全流程持续检查
- 输入：目标 URL + 关注数据类型（API 密钥 / PII / 源码）
- 输出：泄露位置清单 + 严重性分级 + 修复优先级
- 红线：仅检测不利用；测试前确认数据已脱敏
- 关联：上游：所有 hunt-* skill → 下游：reporting skill
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
Workflow
- Fingerprint — Detect technology stack to find known leak patterns
- Static grep — Search HTML/JS for API keys, tokens, emails
- Endpoint scan — Try common paths (.git, .env, /backup, /config)
- Source map analysis — Extract original source from .map files
- Error trigger — Force errors to see stack traces
- Document — Per-leak: type, severity, exploitation path
Advanced Techniques
Source Map Extraction
For JS applications with exposed .map files, use sourcemapper or source-map-resolver to reconstruct original source code and find hardcoded API keys.
Git Directory Exposure
Even partial .git/ exposure can be exploited with git-dumper to reconstruct the repository and find secrets, credentials, and internal documentation.
Source Code Comments
Search for // TODO: remove before prod, // FIXME: insecure, and similar markers - they often indicate known security issues that weren't properly fixed.