What problem does it solve?
This Skill addresses the critical gap of undetected sensitive information disclosures in web applications and APIs that can be leveraged to amplify attack impact, including verbose error messages, exposed source control metadata, production source maps, and differential response oracles that enable user enumeration or object existence checks.
Core Features & Use Cases
- Error & Debug Endpoint Hunting: Detects stack traces, SQL errors, and exposed debug endpoints that reveal internal file paths, framework versions, and database schemas.
- DVCS & Config File Discovery: Identifies exposed .git repositories, .env files, and backup dumps that may contain credentials or sensitive application data.
- Source Map Exploitation: Extracts and analyzes production .js.map files to uncover hardcoded secrets like API keys and environment variables.
- Differential Oracle Detection: Spots response-based enumeration vectors via status codes, response sizes, timing differences, and ETag values.
- Use Case: A penetration tester can use this Skill to find a leaked server file path from an error message, then chain it to a local file inclusion vulnerability to gain full system access.
Quick Start
Use the hunt-information-disclosure skill to scan the target web application for exposed error messages, source maps, and sensitive configuration files to identify chainable attack vectors for your penetration test.
