# Pentest Info Disclosure

> Use when performing penetration testing targeting information disclosure and sensitive data exposure vulnerabilities. Keywords: information disclosure, sensitive data exposure, credential leak, API key exposure, directory listing, error message leakage, debug info, cleartext storage

- Skill: `yhy0/pentest-info-disclosure` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add yhy0/pentest-info-disclosure`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yhy0/pentest-info-disclosure/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: yhy0 (https://skillmd.com/u/yhy0)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/yhy0/pentest-info-disclosure

---


# Information Disclosure Penetration Testing Patterns

当对 Web 应用进行信息泄露渗透测试时加载此 Skill。覆盖凭证泄露、敏感数据暴露、目录列举、错误信息泄露等。

## Attack Surface Discovery

**高风险区域：**
- 公开代码仓库：GitHub/GitLab commit 历史中的 API key、token、密码
- CI/CD 日志：构建日志中暴露的环境变量、凭证
- 错误页面：详细的 stack trace、数据库连接字符串、内部 IP
- API 响应：多余字段泄露（`password_hash`、`internal_id`、`admin_email`）
- 目录列举：`/backup/`、`/.git/`、`/.env`、`/wp-config.php.bak`
- JavaScript 文件：硬编码的 API endpoint、token、内部 URL
- 配置文件暴露：`.env`、`config.yaml`、`application.properties`
- HTTP 响应头：`Server`、`X-Powered-By`、自定义调试头

**识别信号：**
- 响应中包含内部 IP 地址或主机名
- 错误信息暴露框架版本、文件路径
- API 返回不必要的字段（id、hash、internal 字段）

## Exploitation Techniques

**Git 仓库泄露：**
```bash
# 检查 .git 目录是否可访问
curl -s https://target.com/.git/HEAD
curl -s https://target.com/.git/config

# 使用 git-dumper 下载完整仓库
git-dumper https://target.com/.git/ ./output

# GitHub 搜索泄露的凭证
# 搜索 org:target "password" 或 "api_key" 或 "secret"
```

**敏感文件探测：**
```
/.env                    # 环境变量（数据库密码、API 密钥）
/backup.sql              # 数据库备份
/wp-config.php.bak       # WordPress 配置备份
/.DS_Store               # macOS 目录索引
/crossdomain.xml         # Flash 跨域策略
/server-status           # Apache 状态页
/actuator/env            # Spring Boot actuator
/debug/vars              # Go pprof 调试
/graphql/playground       # GraphQL IDE 暴露
/swagger-ui.html         # API 文档
```

**API 信息泄露：**
- 请求不存在的资源，对比 "用户不存在" vs "密码错误" 响应差异（用户枚举）
- 检查 API 响应中是否包含多余字段（使用低权限账户对比）
- 测试 GraphQL introspection：`{ __schema { types { name fields { name } } } }`
- 检查 Verbose 错误模式：触发异常查看是否返回 stack trace

**云凭证泄露：**
- 搜索 CI/CD 日志中的 `AWS_ACCESS_KEY_ID`、`AWS_SECRET_ACCESS_KEY`
- 检查 Docker 镜像层中的环境变量：`docker history --no-trunc image`
- Slack/Discord webhook URL 泄露（可发送任意消息）
- Datadog/Sentry API key 泄露（可读写监控数据）

## Detection Checklist

- [ ] 使用 dirsearch/gobuster 扫描常见敏感路径（.git、.env、backup、config）
- [ ] 检查 Git commit 历史中的凭证（truffleHog、gitleaks）
- [ ] 检查 JavaScript 文件中硬编码的 API key 和 token
- [ ] 触发应用错误观察错误信息详细程度（stack trace、SQL 错误、文件路径）
- [ ] 检查 API 响应中的多余字段（对比不同权限级别）
- [ ] 测试 GraphQL introspection 是否开放
- [ ] 检查 HTTP 响应头中的信息泄露（Server、X-Powered-By）
- [ ] 搜索 CI/CD 日志和公开文档中的凭证
- [ ] 检查 Spring Boot actuator、debug endpoint 是否暴露
- [ ] 验证发现的凭证是否仍然有效（谨慎操作，避免超出授权范围）

## Impact Assessment

**漏洞利用可达到的效果：**
- 凭证窃取：API key、数据库密码、云平台凭证 → 直接接管相关服务
- 源代码泄露：通过 .git 获取完整代码 → 发现更多漏洞
- 内部网络映射：通过泄露的 IP/主机名了解内部架构
- 用户数据泄露：PII、邮箱、手机号等敏感信息暴露
- 供应链攻击：CI/CD token 泄露 → 篡改构建产物

**严重度判断：**
- **Critical**：有效的云凭证（AWS/GCP/Azure）、数据库密码、管理员 token 泄露
- **High**：源代码泄露、API key 泄露可读取敏感数据、大量 PII 暴露
- **Medium**：内部架构信息、版本信息、非敏感配置泄露


## Real-World Cases

以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。

### Case 1: Bykea — Critical Information Disclosure via /talos/api/v1/files/upload

- **严重度**: Critical | **CWE**: Inclusion of Sensitive Information in an Include File
- **摘要**: A vulnerability was discovered in the file upload functionality, where uploaded files were first stored on the server before being sent to S3. Due to a configuration flaw, memory chunks from the serve...
- **报告**: https://hackerone.com/reports/3228011

### Case 2: HackerOne — The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present

- **严重度**: Critical | **CWE**: Information Disclosure
- **摘要**: The /reports/:id.json endpoint disclosed potentially sensitive user attributes, including the reporter's email, OTP backup codes, phone number, graphql_secret_token, and t-shirt size when a reporter s...
- **报告**: https://hackerone.com/reports/3000510

### Case 3: HackerOne — Creation of bounties through Customer API leads to private email disclosure

- **严重度**: Critical | **CWE**: Information Disclosure
- **摘要**: The creation of bounties through the Customer API led to the disclosure of private email addresses. The vulnerability was demonstrated by using both the API and GraphQL requests to award a program bou...
- **报告**: https://hackerone.com/reports/2382120

### Case 4: Khan Academy — Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )

- **严重度**: Critical | **CWE**: Cleartext Storage of Sensitive Information
- **摘要**: The vulnerability allowed attackers to access user accounts on khanAcademy.com using leaked credentials that were publicly available. The credentials were found in clear text format on a third-party w...
- **报告**: https://hackerone.com/reports/3080597

### Case 5: Mars — Datadog api keys exposed can be used to do all the read and write access to the instance

- **严重度**: Critical | **CWE**: Information Disclosure
- **摘要**: A vulnerability was identified where Datadog API keys were exposed in a JavaScript file, which could have enabled unauthorized access to Datadog services. The issue was responsibly disclosed along wit...
- **报告**: https://hackerone.com/reports/2307933

### Case 6: Mozilla — Netlify Authentication Token Exposed in Public Mozilla CI Logs

- **严重度**: Critical | **CWE**: Information Disclosure
- **摘要**: A critical vulnerability was discovered involving the exposure of a Netlify authentication token within publicly accessible logs. The token provided full access to the "Mozilla IT Web SRE" Netlify acc...
- **报告**: https://hackerone.com/reports/2915647

### Case 7: Mozilla — two aws access key and secret key and database username and password exposed 

- **严重度**: Critical | **CWE**: Information Disclosure
- **摘要**: A security vulnerability was identified in a Docker image hosted on Docker Hub. The image, associated with Mozilla's Common Voice project, was found to contain exposed AWS access keys, AWS secret keys...
- **报告**: https://hackerone.com/reports/2401648

### Case 8: Mozilla — Jira Credential Disclosure within Mozilla Slack

- **严重度**: Critical | **CWE**: Information Disclosure
- **摘要**: The Jira admin API keys were disclosed within a Mozilla Slack channel by a staff member. The exposed credentials allowed for the verification of the user's elevated privileges, including being a Jira ...
- **报告**: https://hackerone.com/reports/2467999

### Case 9: Mozilla — Mozilla Employee's Token for sql.telemetry.mozilla.org Exposed in Git Commit

- **严重度**: Critical | **CWE**: Cleartext Storage of Sensitive Information
- **摘要**: A Mozilla employee's API token was exposed in a GitHub repository, granting access to confidential data. The token was rotated and removed from the service.
- **报告**: https://hackerone.com/reports/2193815

### Case 10: Mozilla — Mozilla FuzzManager API Token Exposed in Git Commit

- **严重度**: Critical | **CWE**: Cleartext Storage of Sensitive Information
- **摘要**: An API token for a Mozilla fuzzing service was exposed in a GitHub repository commit. The token provided read-write access to internal fuzzing data. The token was rotated and configured for write-only...
- **报告**: https://hackerone.com/reports/2030076