# Src Info Leak

> Dedicated information leakage hunting skill - identify exposed secrets, debug endpoints, and sensitive data in web applications. Different from generic info-leak: focuses on patterns and places where bounty targets commonly leak (login pages, source code, admin panels). Includes manual review techniques beyond automated scanners.

- Skill: `wufufu770/src-info-leak` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/src-info-leak`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/src-info-leak/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/src-info-leak

---


## TL;DR

- **目的**：Information leakage focused on bounty-relevant patterns
- **适用**：所有 SRC / Bounty 项目（必做）
- **输入**：目标 URL + 关注泄露类型（secrets / debug / PII / source）
- **输出**：泄露点清单 + 严重性 + 影响面
- **红线**：发现后立即通知客户；不要利用泄露的凭据
- **关联**：上游：src-session-start → 下游：info-leak, reporting



## When to Use

- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology

## When NOT to Use

- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
## Workflow

1. **Target fingerprint** — Technology stack, language, framework
2. **Public files** — .git, .env, .DS_Store, backup files
3. **JS source analysis** — Search for API keys, internal endpoints
4. **Error triggering** — Force 500 errors for stack traces
5. **Source maps** — Extract original source from .js.map
6. **Authentication bypass** — Try default creds, register new account
7. **Document** — Per-leak: type, severity, reach, fix



## Advanced Techniques

### Sensitive String Extraction
After finding source maps, grep for: AWS keys (AKIA[0-9A-Z]{16}), JWT tokens (eyJ.+\..+\..+), private keys (-----BEGIN), database URLs (postgres://, mongodb://), API keys (sk_live_, AIza, etc.).

### Git History Mining
If `.git/` is exposed, use `git log -p` to find secrets that were removed in later commits but still exist in history.

### Configuration Files
Common exposed paths: `.env`, `config.json`, `wp-config.php`, `application.properties`, `appsettings.json`. Always check both root and common subdirectories.