skills.rest
baiqigo
baiqigoCOMMUNITY
Explore all skills by this author →
GitHub

hunt-source-leak

Detect exposed source maps, Swagger specs, .git directories, and .env files during web reconnaissance.

10|3|Updated Aug 10, 2026
Search Tags:#reconnaissance#web security#swagger#bug bounty#secret scanning#source maps#git exposure
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-source-leak-baiqigo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-source-leak
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/hunt-source-leak
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-source-leak-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires git-dumper, trufflehog, ds_store.

What problem does it solve? Web applications frequently leak source code, API specifications, and credentials through misconfigured build artifacts, and manually probing dozens of well-known paths is slow and error-prone. This Skill systematizes the detection of source code and build artifact leakage so testers can find high-impact exposures early in a recon session. ## Core Features & Use Cases - Source Map Reconstruction: Discovers .js.map files, extracts original TypeScript/ES6 source, and greps it for hardcoded API keys, secrets, and internal endpoints, with explicit guidance on content-hash rotation so stale 404s are not mistaken for remediation. - API Surface Discovery: Probes common Swagger/OpenAPI paths and parses the JSON to enumerate all endpoints, parameters, and auth schemes. - Repository and Config Exposure: Checks for .git directory exposure (with git-dumper reconstruction and trufflehog history scanning), .env files, build-info, .DS_Store listings, and webpack chunks containing secrets. - Use Case: At the start of an authorized bug bounty engagement, run the phased checks against the target to recover a full source map revealing internal API routes, then chain that into testing undocumented admin endpoints. ## Quick Start Use the hunt-source-leak skill to check my authorized target for exposed source maps, Swagger specs, .git directories, and .env files, then report any secrets or internal endpoints found.

Frequently Asked Questions about hunt-source-leak

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed source maps on a website?▼

Extract the current JS bundle filename from the page HTML, then request the same path with a .map extension appended. Always derive the content hash live because bundle names rotate on every deploy, and a 404 on an old URL does not mean the exposure was fixed.

How to extract source code from a .js.map file?▼

Download the map file and parse its JSON, reading the sources and sourcesContent arrays. Write each entry to disk to reconstruct the original TypeScript or ES6 files, then grep the output for API keys, secrets, and internal endpoints.

What tools check for exposed .git directories?▼

First request /.git/HEAD and confirm it returns a ref line. If exposed, use git-dumper to reconstruct the full repository, then run trufflehog over the git history to find secrets committed in the past.

Why does a source map URL return 404 after a redeploy?▼

Bundle filenames are content-hashed, so every deploy generates a new name and the old URL stops resolving. The map is usually still published under the new hash; only disabling source map generation or stripping .map files at deploy actually remediates it.

What severity is an exposed .env or .git directory?▼

An exposed .env containing credentials and a .git directory with secrets in history are both rated Critical. Source maps with secrets are High, Swagger exposing internal routes is Medium-High, and robots.txt alone is Informational.

Related Skills

Explore More Software Engineering Skills→
noname300989noname300989

recon

Automates OSINT, subdomain discovery, HTTP probing, and active port scanning to map attack surfaces.

Community
Advanced
noname300989noname300989

api-tester

Automate security assessments of REST and GraphQL API endpoints.

Community
Advanced
overtimepogovertimepog

cve-lookup

Correlate CVEs against target technology stacks and assess exploit availability.

Community
Advanced
david-nossebrodavid-nossebro

web-qa-expert

Run black-box manual QA on web apps via Playwright CLI and return findings-only reports.

Community
Intermediate