skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

source-leak-hunt

Scan multiple domains for exposed sensitive files like .env and .git/config.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#secrets#pentest#exposure#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill source-leak-hunt-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: source-leak-hunt
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/source-leak-hunt
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill source-leak-hunt-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill addresses the critical security risk of accidentally exposed sensitive files like environment variables, database backups, and git configurations that can lead to full system compromise.

Core Features & Use Cases

  • Mass Scanning: Efficiently probes large lists of domains for common sensitive file paths.
  • Content-Based Filtering: Uses pattern matching to verify leaks, significantly reducing false positives from parked domains or SPA catch-all pages.
  • Use Case: Use this during the reconnaissance phase of a security assessment to quickly identify misconfigured servers leaking database credentials or source code.

Quick Start

Run the source-leak-hunt skill by providing a text file containing a list of target URLs to scan for exposed sensitive files.

Frequently Asked Questions about source-leak-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan multiple domains for exposed sensitive files like .env and .git config?▼

You can scan multiple domains for exposed sensitive files by providing a text file containing target URLs to perform mass scanning for misconfigured servers leaking credentials and source code.

Can I use mass scanning to find exposed database backups and environment variables across large target lists?▼

Yes, mass scanning efficiently probes large lists of domains for common sensitive file paths, identifying exposed environment variables and database backups to prevent full system compromise.

How do I reduce false positives when scanning for exposed .env files and config leaks?▼

Content-based filtering uses pattern matching to verify leaks, significantly reducing false positives from parked domains or SPA catch-all pages during sensitive file exposure scanning.

Do I need subfinder and nuclei to identify exposed secrets and config files?▼

Yes, identifying exposed secrets requires subfinder for network discovery and nuclei for content verification, along with curl, nmap, python3, masscan, and httpx.

What is the best way to find credential exposure during a security assessment reconnaissance phase?▼

The best way to find credential exposure during reconnaissance is using a dedicated source leak hunting skill to quickly identify misconfigured servers leaking database credentials or source code.

When should I not use automated sensitive file scanning for vulnerability assessment?▼

Automated sensitive file scanning is not recommended without proper authorization, as probing target domains for exposed configurations and credentials requires explicit permission during security assessments.

Related Skills

Explore More Software Engineering Skills→
adoreseveradoresever
202

summarize

Summarize text from URLs, transcripts, and local files into concise summaries.

Community
Intermediate
EntroVyxEntroVyx
3

error-log-mining

Extract credentials, server paths, and database schemas from exposed PHP error logs.

Community
Intermediate
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
uphiagouphiago
1.1k

wp-mass-recon

Batch scan domains for WordPress vulnerabilities and generate prioritized reports.

Community
Advanced