wufufu770 TL;DR
- 目的：Information leakage focused on bounty-relevant patterns
- 适用：所有 SRC / Bounty 项目（必做）
- 输入：目标 URL + 关注泄露类型（secrets / debug / PII / source）
- 输出：泄露点清单 + 严重性 + 影响面
- 红线：发现后立即通知客户；不要利用泄露的凭据
- 关联：上游：src-session-start → 下游：info-leak, reporting
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
Workflow
- Target fingerprint — Technology stack, language, framework
- Public files — .git, .env, .DS_Store, backup files
- JS source analysis — Search for API keys, internal endpoints
- Error triggering — Force 500 errors for stack traces
- Source maps — Extract original source from .js.map
- Authentication bypass — Try default creds, register new account
- Document — Per-leak: type, severity, reach, fix
Advanced Techniques
Sensitive String Extraction
After finding source maps, grep for: AWS keys (AKIA[0-9A-Z]{16}), JWT tokens (eyJ.+..+..+), private keys (-----BEGIN), database URLs (postgres://, mongodb://), API keys (sk_live_, AIza, etc.).
Git History Mining
If .git/ is exposed, use git log -p to find secrets that were removed in later commits but still exist in history.
Configuration Files
Common exposed paths: .env, config.json, wp-config.php, application.properties, appsettings.json. Always check both root and common subdirectories.