{
  "slug": "info-disclosure",
  "title": "Information Disclosure",
  "phase": "Enumeration",
  "description": "Identify unintentional exposure of sensitive data — API keys, credentials, stack traces, internal hostnames, and developer artifacts — across all discovered surfaces.",
  "difficulty": "low",
  "tags": [
    "analysis",
    "secrets",
    "disclosure",
    "js-analysis",
    "git",
    "headers",
    "error-handling"
  ],
  "tools": [
    "nuclei",
    "gitleaks",
    "trufflehog",
    "gospider",
    "grep",
    "curl"
  ],
  "steps": [
    {
      "id": "infodis-01",
      "title": "JavaScript secret scanning",
      "description": "Scan all JavaScript files for hardcoded credentials, API keys, and internal endpoints.",
      "commands": [
        "cat js-files.txt | xargs -I{} curl -sk {} | grep -iE '(api_key|apikey|secret|password|token|bearer|auth|private|aws_|AKIA)'",
        "nuclei -l js-files.txt -t exposures/tokens/ -t exposures/apis/ -o js-secrets.txt",
        "trufflehog filesystem ./downloaded-js/ --json > trufflehog-out.json"
      ]
    },
    {
      "id": "infodis-02",
      "title": "Git and VCS exposure",
      "description": "Check for exposed .git directories, CI configs, and source code leakage.",
      "commands": [
        "curl -sk https://target.com/.git/config",
        "curl -sk https://target.com/.git/HEAD",
        "nuclei -l live-hosts.txt -t exposures/files/git-config.yaml -o git-exposure.txt",
        "gitjacker https://target.com -o git-dump/"
      ],
      "notes": "A reachable .git/config reveals the repository origin URL, author emails, and sometimes credentials stored in the remote URL."
    },
    {
      "id": "infodis-03",
      "title": "HTTP response header analysis",
      "description": "Review HTTP headers for server fingerprints, internal addresses, and security misconfigurations.",
      "commands": [
        "curl -sk -I https://target.com | grep -iE '(server|x-powered-by|x-aspnet|x-generator|via|x-forwarded|x-real-ip)'",
        "nuclei -l live-hosts.txt -t misconfiguration/http-missing-security-headers.yaml -o headers-out.txt",
        "httpx -l live-hosts.txt -include-response-header -o headers-full.txt"
      ],
      "notes": "X-Powered-By, Server, and X-AspNet-Version headers reveal exact technology versions. Cross-reference with known CVEs."
    },
    {
      "id": "infodis-04",
      "title": "Error message and stack trace harvesting",
      "description": "Trigger application errors to expose framework details, file paths, and internal logic.",
      "commands": [
        "curl -sk -X POST https://target.com/api/users -d '{\"id\": \"../../../etc/passwd\"}' -H 'Content-Type: application/json'",
        "ffuf -u 'https://target.com/api/FUZZ' -w special-chars.txt -mc 500 -o errors-out.json"
      ]
    },
    {
      "id": "infodis-05",
      "title": "Cloud storage and backup file enumeration",
      "description": "Check for exposed S3 buckets, GCS buckets, and backup file extensions.",
      "commands": [
        "ffuf -u 'https://target.com/FUZZ' -w /usr/share/seclists/Discovery/Web-Content/backups.txt -mc 200 -o backups-out.json",
        "nuclei -l live-hosts.txt -t exposures/backups/ -o backup-findings.txt",
        "aws s3 ls s3://target-bucket --no-sign-request"
      ]
    }
  ],
  "references": [
    "https://github.com/gitleaks/gitleaks",
    "https://github.com/trufflesecurity/trufflehog",
    "https://github.com/projectdiscovery/nuclei",
    "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure",
    "https://portswigger.net/web-security/information-disclosure"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-04-04"
}