source-leak-hunt

What problem does it solve?

This Skill eliminates the tedious, error-prone manual work of checking web targets for exposed sensitive files like .env configs, backup files, git repositories, and debug logs, which often contain critical credentials and internal data that enable deeper attacks during reconnaissance and penetration testing.

Core Features & Use Cases

• Parallel Mass Path Scanning: Checks 20+ common sensitive paths across hundreds of live targets in parallel to speed up large-scale recon efforts.
• False Positive Filtering: Uses content pattern matching to eliminate false alerts from single-page apps, CDN error pages, and parked domains that return HTTP 200 for all paths.
• Credential Extraction & Triage: Automatically extracts credentials from leaked .env files, wp-config backups, and SQL dumps, and flags targets with 3+ leaks for prioritized deep-dive analysis.
• Use Case: A red teamer scanning 500 live web targets after initial uptime checks can use this Skill to quickly identify the ~7% of targets with exposed source leaks, cutting hours of manual work down to minutes.

Quick Start

Use the source-leak-hunt skill to scan a list of live target URLs for exposed sensitive files and extract any verified leaked credentials.