SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsinformation-disclosure-methodology

information-disclosure-methodology

General & other

View repository

Updated 10-16 08:01

About this skill

Information Leakage Methodology

⛔ In-Depth Reference (Required Reading)

Phase 1: Source Code and Configuration Files

Directly request common sensitive paths (test one by one or batch scan):

/.git/HEAD          /.env              /config.py         /Dockerfile
/.svn/entries       /.svn/wc.db        /.DS_Store         /robots.txt
/WEB-INF/web.xml    /package.json      /app.py            /backup.sql
/.dockerenv         /composer.json     /Gemfile           /requirements.txt
  1. Use curl -s -o /dev/null -w '%{http_code}' http://TARGET/<path> to batch detect status codes
  2. For 200 responses, further check whether the content is a real file (rule out custom 404 pages)
  3. .git/HEAD returns 200 → git-dumper full dump → git log audit historical commits to find passwords/flags!
  4. .svn/entries or .svn/wc.db returns 200 → svn-extractor dump → extract file list and contents
  5. .env returns 200 → directly read sensitive configurations such as database connection strings, API Keys, SECRET_KEY, etc. → Detailed source code recovery steps → references/source-recovery.md

Phase 2: Debug Information

  1. Send malformed requests to trigger 500 error pages (missing parameters, type mismatch, illegal characters)
  2. Flask debug=True displays full source code and interactive debugger (may directly lead to RCE)
  3. Django DEBUG=True displays settings, URL routing, SQL queries
  4. Extract from Stack Trace: absolute file paths, framework version, database type, variable values
  5. Check response Header:Server、X-Powered-By、X-Debug-Token、X-Request-Id
  6. Try to access /debug、/trace、/actuator（Spring Boot）、/elmah.axd（.NET）

Phase 3: API Documentation Leakage

  1. Request documentation endpoints one by one:/docs、/swagger、/swagger.json、/swagger-ui.html
  2. Additional paths:/openapi.json、/redoc、/api-docs、/graphql、/graphiql
  3. Check /v1/docs、/v2/docs and other paths with version prefixes
  4. Extract from API documentation: list of all endpoints, parameter types and example values, authentication methods, data model definitions
  5. Focus on admin interfaces (/admin/*), user management (/users), file operations (/upload、/download）
  6. GraphQL introspection query:{__schema{types{name,fields{name}}}}

Phase 4: Backups and Logs

  1. Scan backup files:/backup.zip、/backup.tar.gz、/app.py.bak、/web.config.old
  2. Filename variants:index.php.bak、index.php~、index.php.swp、.index.php.swp
  3. Log files:/access.log、/error.log、/debug.log、/app.log
  4. Use spray or ffuf together with a backup dictionary to scan more paths
  5. Database backups:/dump.sql、/db.sql、/database.sql、/backup.sql
  6. Version control remnants:/.hg/（Mercurial）、/.bzr/（Bazaar）

Phase 5: API Parameter Manipulation

  1. After discovering an API endpoint, perform four manipulations on query parameters: blank out,% wildcard, null, delete parameter
  2. pageSize=9999 amplify pagination to obtain more data
  3. info → list endpoint transformation, look for list interfaces
  4. Empty array [] → delete Token, test authentication bypass
  5. Add verbose=true、debug=1 parameter, check whether additional information is returned → Detailed techniques and cases → references/api-param-tricks.md

Phase 6: Credential Search

  1. Search in the obtained source code/configuration:password、secret、api_key、token、mysql://
  2. Check .env database connection strings and third-party API keys in the file
  3. Search for SSH private keys:/.ssh/id_rsa、/home/*/.ssh/id_rsa
  4. Base64-encoded credentials: decode all Base64 strings to inspect the contents
  5. Use credentials immediately upon finding them: log in to the web, SSH connections, direct database connections
  6. Search Git history for deleted passwords:git log -p -S 'password'