skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-source-leak

Detect exposed source code and build artifacts during web reconnaissance.

1.1k|191|Updated Jun 24, 2026
Search Tags:#API discovery#secret extraction#git exposure#web recon#source leak detection#source map analysis
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-source-leak-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-source-leak
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-source-leak
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-source-leak-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

During offensive security reconnaissance, exposed source code artifacts, configuration files, and build outputs often contain critical hardcoded secrets, internal API endpoints, and sensitive infrastructure details that are invisible to standard scanning tools, unlocking the full attack surface without manual brute-forcing or social engineering.

Core Features & Use Cases

  • Multi-vector leak detection: Scans for 8+ high-value exposure types including JavaScript source maps, Swagger/OpenAPI specifications, exposed .git directories, .env configuration files, webpack chunks, .DS_Store directory listings, and build-info artifacts.
  • Automated secret and endpoint extraction: Reconstructs full source code from source maps, parses API specs to enumerate all endpoints, and greps raw JS bundles for hardcoded API keys, internal hostnames, and non-public environment variables.
  • Edge case resilient workflows: Includes built-in fallbacks for common pitfalls like fake source maps (SPAs serving HTML for .map URLs) and minimal container environments without Perl-compatible grep, plus chain tables to link discovered leaks to immediate exploitation steps.
  • Use case example: For a target React SPA that returns fake HTML source maps, this skill can automatically analyze raw JS bundles to discover an undocumented internal API server running on a non-standard port, revealing a new high-value attack surface in seconds.

Quick Start

Use the hunt-source-leak skill to scan the target domain for exposed source maps, .env files, and .git directories to extract hardcoded secrets and internal API endpoints.

Frequently Asked Questions about hunt-source-leak

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed source code and hidden API endpoints during web reconnaissance?▼

To find exposed source code and hidden API endpoints during web reconnaissance, scan for high-value artifacts like JavaScript source maps, exposed .git directories, and .env files. This automated detection extracts hardcoded secrets and internal endpoints without manual brute-forcing.

What is the best way to detect hardcoded secrets in JavaScript bundles and webpack chunks?▼

The best way to detect hardcoded secrets in JavaScript bundles and webpack chunks is by using automated leak detection to analyze raw JS bundles. This process reconstructs full source code from source maps and greps for API keys and non-public environment variables.

Can I enumerate REST API endpoints from Swagger or OpenAPI specifications automatically?▼

Yes, you can automatically enumerate REST API endpoints by parsing exposed Swagger or OpenAPI specifications. This multi-vector leak detection parses API specs to uncover all undocumented internal endpoints and sensitive infrastructure details quickly.

How do I handle fake source maps that return HTML instead of JavaScript during penetration testing?▼

To handle fake source maps that return HTML during penetration testing, use edge case resilient workflows with built-in fallbacks. When SPAs serve HTML for .map URLs, the analysis automatically targets raw JS bundles to discover internal API servers instead.

Does source leak detection work in minimal container environments without Perl-compatible grep?▼

Yes, source leak detection works in minimal container environments without Perl-compatible grep. The workflow includes built-in fallbacks for minimal container environments, ensuring you can still extract sensitive configuration data and discover hidden attack surface.

What types of build artifact leakage should I scan for when targeting SPAs?▼

When targeting SPAs, you should scan for 8+ high-value build artifact leakage types including JavaScript source maps, webpack chunks, .DS_Store directory listings, and build-info artifacts to uncover hardcoded secrets and sensitive infrastructure details.

Related Skills

Explore More Software Engineering Skills→
rafaelcallejarafaelcalleja
2

ffuf-web-fuzzing

Fuzz web resources to discover hidden directories, files, and subdomains.

Community
Advanced
uphiagouphiago
1.1k

hunt-information-disclosure

Detect sensitive information disclosure vulnerabilities in web applications and APIs.

Community
Intermediate
dreadnodedreadnode
11

shodan-reconnaissance

Enrich BBOT reconnaissance results with Shodan host intelligence and CVE correlation.

Official
Intermediate
AeonDaveAeonDave
15

dirsearch

Scan web servers for hidden directories and files with recursive scanning.

Community
Intermediate