---
name: Information Disclosure Hunting
slug: information-disclosure-hunting
category: Quality
description: Information Disclosure Hunting finds exposed credentials, leaked secrets, debug endpoints, and other confidentiality-only issues. Use it when checking for .env or .git exposure, Spring Actuator leaks, source disclosure, or stack traces.
github: "https://github.com/H-mmer/pentest-agents/tree/main/skills/hunt-info-disclosure"
language: Python
stars: 804
forks: 156
install: "npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/hunt-info-disclosure ~/.claude/skills/hunt-info-disclosure"
installs_to: ~/.claude/skills/hunt-info-disclosure
source_path: skills/hunt-info-disclosure/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/H-mmer/pentest-agents"
added: 2026-08-22T05:22:30.433Z
last_synced: 2026-08-22T05:22:30.433Z
canonical_url: "https://dirskills.com/skills/information-disclosure-hunting"
---

# Information Disclosure Hunting

Information Disclosure Hunting finds exposed credentials, leaked secrets, debug endpoints, and other confidentiality-only issues. Use it when checking for .env or .git exposure, Spring Actuator leaks, source disclosure, or stack traces.

**Install:**

```bash
npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/hunt-info-disclosure ~/.claude/skills/hunt-info-disclosure
```

## README

## Crown Jewel Targets

Information disclosure is the most-volume bug class in bug bounty (~30% of all disclosed reports across H1/Bugcrowd hacktivity), but the paying surface has shifted decisively toward **systemic credential exposure** rather than one-off PII leaks. Reflected stack traces on a 404 page are mid-three-figure or N/A on most programs; an exposed `/actuator/heapdump` containing AWS keys is mid-five-figure-class because it cascades to RCE on production cloud infrastructure. The 24-month meta crystallized around seven asset types. All CVEs below are NVD-verified.

**1. Spring Boot Actuator exposure (mid four-figure to mid five-figure when chained to cloud takeover).** Wiz Threat Research Dec 2024 analysis: **60% of cloud environments use Spring Boot Actuator, 11% expose instances publicly to the internet, 24% of exposed instances are misconfigured.** **Volkswagen 9TB GPS data disclosure** — single open `/actuator/heapdump` endpoint provided plaintext AWS keys via heap dump, attackers downloaded 9 TB of GPS data from hundreds of thousands of cars. Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/ (SYSCREST analysis Feb 2025), https://www.cyberkendra.com/2024/12/vulnerability-in-spring-boot-actuator.html (Wiz research summary Dec 2024). NVD-verified CVEs in the family:
- **CVE-2025-41243 Spring Cloud Gateway Server Webflux property modification (CVSS 10.0 CRITICAL)** — when actuator gateway endpoint exposed via `management.endpoints.web.exposure.include=gateway`, attackers modify Spring Environment properties remotely → potential RCE. Affects 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.1.x. Fix in 4.3.1 / 4.2.5 (OSS); 4.1.11 / 3.1.11 (Enterprise).
- **CVE-2025-41253 Spring Cloud Gateway info-disclosure (CVSS 7.5 HIGH)** — SpEL injection on actuator endpoint exposes environment variables and system properties (DB credentials, API keys, internal URLs).
- **CVE-2025-22235 Spring Boot EndpointRequest.to() wrong matcher (CVSS 7.3 HIGH)** — disabled actuator endpoint creates unprotected `/null/**` matcher path.
- **CVE-2025-8525 Exrick xboot Spring Boot Admin/Actuator info disclosure** (CVSS 5.5 MEDIUM).
- **CVE-2025-8738 zlt2000 microservices-platform actuator interface** (CVSS 5.5 MEDIUM).

The Wiz dashboard checklist for actuator endpoints: `/health` (low), `/prometheus` `/metrics` (medium), `/env` (HIGH — never expose), `/heapdump` (CRITICAL — never expose), `/beans` `/mappings` `/loggers` (high — internal/auth only), `/shutdown` (HIGH — disabled by default, never enable).

**2. `.git/` and `.env` mass exposure (mid four-figure direct + supply-chain cascades).** Two large 2024-2025 disclosures show this is industrialized:
- **Sysdig EmeraldWhale Oct 2024** — automated scanning of IP ranges for exposed `/.git/config` files. Stole **15,000 cloud credentials from 67,000 URLs** (28K Git repos, 6K GitHub tokens, 2K validated active credentials). Stored stolen secrets in 1TB S3 bucket. Reference: https://sysdig.com/blog/emeraldwhale, https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/.
- **Unit42 (Palo Alto) Aug 2024** — large-scale .env extortion campaign scanned 110,000 domains, identified **90,000 unique combos of leaked env-vars including 7,000 active AWS access keys**. Targeted Mailgun-mentioning .env files for legitimate-domain phishing. Reference: https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation.

Pattern: web servers serving Laravel, Symfony, Rails, Django apps mistakenly serve the application root including `.env` and `.git/`. Hunt with: `curl -s https://target/.env`, `curl -s https://target/.git/config`, `curl -s https://target/.git/HEAD`. Then `git-dumper https://target/.git/ /tmp/dumped` to recover the full repo.

**Disclosed bug bounty cases**: NASA `_x3ro_` Bugcrowd disclosure (Aug 2025, P3) — publicly accessible `.env` on NASA Bitbucket exposed UAT credentials for `cmr.sit.earthdata.nasa.gov`. Reference: https://redpacketsecurity.com/bugcrowd-bugbounty-disclosure-publicly-accessible-env-file-exposing-hardcoded-credentials-on-nasa-s-git-repository.

**3. Source-code repository secret leakage (CWE-798, low five-figure on triage-friendly programs).** **GitGuardian 2026 State of Secrets Sprawl**: 28.65M new hardcoded secrets added to public GitHub repos in 2025 (34% YoY increase). **GitHub's own 2024 secret-scanning report**: 39M secret leaks. **IEEE S&P 2025 academic study**: up to 30% of projects at risk. **Starbucks H1 #716292 (2019, Cremit reference)** — single leaked JumpCloud API key in public GitHub repo, classified CWE-798, **CVSS 9.7 critical**, paid bounty — proof that bug bounty programs CAN treat credential exposure as paying class. Reference: https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure (Apr 2026 Cremit research on this exact pattern).

Hunt with **TruffleHog** (https://github.com/trufflesecurity/trufflehog, 26K+ stars, 800+ detectors, **active credential verification** against provider APIs to confirm still-live keys). Same pattern via **GitGuardian**, **Snyk Code SAST**, **GitHub Secret Scanning**. Caveat from Cremit Apr 2026 analysis: **most bug bounty programs still classify credential exposure as out-of-scope** — check program scope before reporting; many specifically EXCLUDE this finding class.

**4. Cloud-bucket misconfig (S3, GCS, Azure Blob — mid four-figure when PII counted; informational P5 when generic).** **ESHYFT March 2025** — 108GB / 86,341 healthcare-worker records (medical IDs, drivers licenses, SSNs, prescription records, disability claims) in unsecured S3 bucket; researcher Jeremiah Fowler discovered, took >1 month for org to close. Reference: https://www.theregister.com/2025/03/11/uber_for_nurses_exposes_86k/. **NASA Bugcrowd disclosure Feb 2025** — PDF in public S3 bucket (P5 informational only — NASA's VDP triages cloud-bucket findings strictly). Reference: https://bugcrowd.com/disclosures/aa45924f-8b67-4f22-8dff-dac7dc9d60e2/exposure-of-pdf-file-in-a-public-amazon-s3-bucket-associated-with-nasa.

Hunt with **`s3scanner`**, **`AWSBucketDump`**, subdomain enumeration → `<name>.s3.amazonaws.com`, `<name>.blob.core.windows.net`, `<name>.storage.googleapis.com`. The Wiz Cloud Security Index annual report tracks the most-common misconfig classes.

**5. Debug endpoint family (Spring actuator, Go pprof, Glances, FUXA, NetBird, Harbor — low four-figure to low five-figure depending on what's exposed).** All NVD-verified or GHSA-verified, all 2025-2026:
- **Dgraph `/debug/pprof/cmdline` (GHSA-95mq-xwj4-r47p)** — unauthenticated debug endpoint exposes full process command line including admin token from `--security "token=..."`. Critical.
- **Glances `/api/4/serverslist` (GHSA-r297-p3v4-wp8m, GHSA-gfc2-9qmw-w7vh)** — Central Browser mode REST API returns raw server objects with reusable downstream credentials; permissive CORS allows any origin.
- **FUXA plaintext DB credentials (GHSA-c5gq-4h56-4mmx)** — unauthenticated remote attacker retrieves administrative database credentials.
- **Harbor default password (GHSA-hj7x-hmf2-hc2p)** — GoHarbor v2.15.0 and below allows default password for web UI login.
- **NetBird VPN (GHSA-g3j4-58mp-3x25)** — installation script fails to remove ZITADEL-created default admin password.
- **MinIO LDAP brute-force (GHSA-jv87-32hw-hh99)** — `AssumeRoleWithLDAPIdentity` STS endpoint vulnerable to brute-forcing due to user enumeration + missing rate limit.
- **PraisonAI WebSocket Gateway (GHSA-cfh6-vr3j-qc3g)** — `/ws` and `/info` endpoints serve agent topology with no auth; any network client can connect, enumerate registered agents.
- **Gradio ACL bypass (GHSA-j2jg-fq62-7c3h)** — file path ACL bypassed via case alteration; lack of case normalization.
- **Rancher cluster template credentials in answers** — credentials not properly sanitized.
- **ArgoCD Redis cache risky/missing crypto** — credentials cached without proper encryption.
- **`/server-status`** Apache mod_status endpoint — H1 report 2473173 (2026 High) — exposed at `https://203.137.128.240/server-status` leaks request URLs, IPs, vhosts.

**6. PII exposure via API misconfiguration (CVSS-Confidentiality-only, low four-figure to low five-figure depending on record count).** Recent disclosed examples:
- **ASBS soldiers PII** (H1 2026 critical) — viewing other soldiers' Personnel Information / Board / Board Voters via the Army Body Score System.
- **`/talos/api/v1/files/upload` Critical Information Disclosure** (H1 report 3228011, 2025 critical).
- **IBM Aspera HTTP Gateway** (H1 report 3340797, 2026 high) — sensitive information stored in clear text in easily obtainable files.
- **ORDER_ERROR_LOG PII Data Exposure** (H1 2026 high) — error-log endpoint returns PII for any order ID.
- **Session Cookie Leakage via Static Header Field in WebViewerFragment** (H1 2026 high) — mobile WebView leaks session via static header.

Hunt: every API endpoint that returns user data, every error/log endpoint, every export feature, every `/me` and `/users/{id}` route.

**7. WordPress wp-config.php exposure (mid three-figure to mid four-figure; reliable VDP filler).** Multiple H1 reports 2026: report 3328408 (National Guard website), report 3252302. Pattern: `.bak`, `.old`, `~`, `.swp` backup files served alongside `wp-config.php` containing DB credentials. Hunt with: `curl https://target/wp-config.php{,.bak,.old,~,.swp}`. The BackupFinder ffuf wordlist covers the common variants.

**Memory disclosure (Heartbleed-class, when found pays mid five-figure).** **Dgraph `/debug/pprof/cmdline`** above. **`.NET Framework ObjRefs Disclosure (CVE-2024-29059)`** — H1 2026 high — .NET Remoting ObjRefs reveal internal endpoints. Modern memory-disclosure findings rare but high-impact when chained.

**Mobile / game / IoT disclosure** — **ASLR leak in Mario Kart World through LAN mode** (H1 2026 high). Mobile-app reverse-engineering finds API keys, internal URLs in compiled binaries. Game-engine memory disclosure via LAN/multiplayer protocols.

**What pays the most:** Spring actuator heapdump → cloud takeover (mid five-figure when chained — Volkswagen-class). Source-code repo with active AWS keys (low five-figure on programs that accept the class — Starbucks H1 #716292 precedent). Mass-PII via API misconfig (mid four-figure × record-count multiplier on healthcare/financial). `.env` exposure with active credentials (low four-figure direct + chain to AWS infrastructure for upgrade). `.git/` exposure (low four-figure direct + recover full repo + extract secrets). Generic stack trace, version banners, README leak — N/A on most programs.

## Attack Surface Signals

Greppable signals that this surface might exist:

```bash
# Spring Boot Actuator endpoints (CVE-2025-41243 family + Volkswagen pattern)
rg -n -e 'management\.endpoints\.web\.exposure\.include' \
   -e 'spring-boot-starter-actuator' \
   -g 'application*.{yml,yaml,properties}' -g '*.gradle' -g 'pom.xml'

# Spring actuator endpoints exposed in code
rg -n -e '@Endpoint' -e '@WebEndpoint' -e '@ReadOperation' --type java

# Hardcoded secrets / credentials in source
rg -n -e 'AKIA[0-9A-Z]{16}' \
   -e 'AIza[0-9A-Za-z_-]{35}' \
   -e 'sk_live_[0-9a-zA-Z]{24,}' \
   -e 'ghp_[0-9a-zA-Z]{36}' \
   -e 'github_pat_[0-9a-zA-Z]{82}' \
   -e 'xox[bpoa]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}' \
   -e 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' \
   -g '!*.lock' -g '!node_modules' -g '!vendor'

# Database connection strings
rg -n -i -e 'jdbc:(?:mysql|postgresql|mariadb|oracle|mssql)://[^"\s]*:[^@\s]+@' \
   -e 'mongodb(\+srv)?://[^"\s]*:[^@\s]+@' \
   -e 'redis://[^"\s]*:[^@\s]+@' \
   -e 'amqp://[^"\s]*:[^@\s]+@'

# .env file references in code (suggest .env exists in deploy)
rg -n -e 'process\.env\.\w+' -e 'os\.environ\[' -e 'env\(\'?\w+\'?\)' \
   --type js --type ts --type py --type php

# Debug / pprof endpoints in Go code
rg -n -e 'net/http/pprof' -e '"/debug/pprof"' -e '_pprof' --type go

# Verbose error / debug mode in framework configs
rg -n -i -e 'debug\s*=\s*true' -e 'app_debug=true' \
   -e 'DEBUG\s*:\s*True' -e 'DJANGO_DEBUG=True' \
   -g '*.{yml,yaml,toml,ini,env,properties}'

# Stack-trace exposure in error handlers (Express/Flask)
rg -n -e 'app\.use\(function\(err' -e 'errorhandler\(' \
   -e '@app\.errorhandler' -e 'send.*error\.stack' \
   --type js --type ts --type py
```

HTTP-level signals on a live target:

- `Server: Tomcat`, `X-Application-Context:`, `Server: Jetty` + `/actuator/health` returns 200 → **Spring Boot Actuator surface** (probe `/actuator/heapdump`, `/actuator/env`, `/actuator/beans`)
- `Server: Apache` + Apache `mod_status` enabled → **`/server-status` info disclosure** (H1 report 2473173, 2026 High)
- `X-Powered-By: PHP/X.Y.Z` + `phpinfo()` reachable at common paths → **CVE-class info disclosure**
- `X-Powered-By: ASP.NET`, `.NET Remoting` enabled → **CVE-2024-29059 .NET Framework ObjRefs disclosure** family
- Subdomain returns Laravel default page → probe `https://target/.env` directly
- Any 200 OK on `https://target/.git/HEAD` or `https://target/.git/config` → **`.git/` exposure** (Sysdig EmeraldWhale class)
- `Vary: Accept-Encoding` + `text/html` response on `https://target/wp-config.php{,.bak,.old,~}` → **WordPress wp-config exposure** (H1 reports 3328408, 3252302, 2026 High)
- Open `<bucket>.s3.amazonaws.com`, `<bucket>.blob.core.windows.net`, `<storage>.googleapis.com` returns XML directory listing → **S3 / Azure / GCS bucket misconfig** (ESHYFT-class)
- `/api/v1/info`, `/api/4/serverslist`, `/info`, `/version`, `/build-info` returning verbose data → **Glances-class** (GHSA-r297-p3v4-wp8m)
- `/debug/pprof/cmdline` returns process command line including secrets → **Dgraph-class** (GHSA-95mq-xwj4-r47p)
- Login page returning different responses for valid vs invalid usernames → **user enumeration** surface (MinIO GHSA-jv87-32hw-hh99 LDAP variant)
- `/swagger.json`, `/api-docs`, `/openapi.json`, `/.well-known/openapi` exposed in production → **API documentation exposure**
- 500 error response includes full stack trace, file paths, framework version → **stack-trace info disclosure**
- `WWW-Authenticate: Basic realm="..."` exposing internal app names → **internal hostname disclosure**
- `Set-Cookie: <SESSION>=<value>; Domain=.target.com; Path=/` (no `Secure`, no `HttpOnly`) → **session-cookie leakage surface**

## Insertion Point Taxonomy

Every place sensitive content leaks for info-disclosure:

- **Source-code repos** (.git/.svn/.hg directories served by web server, public GitHub repos with embedded secrets, leaked private repo via dependency) — Sysdig EmeraldWhale 2024
- **Configuration files** (.env, wp-config.php, web.config, application.properties, settings.py, config.json) — Unit42 110K-domain scan 2024
- **Backup files** (.bak, .old, ~, .swp, .swo, .DS_Store, _bak, .backup, .copy) — manual fuzzing target
- **Debug / health / actuator endpoints** (/actuator/*, /debug/pprof/*, /api/health, /api/info, /api/build-info) — Wiz Threat Research 2024
- **Error pages / stack traces** (any 500 / 404 / unhandled exception) — framework-version + path disclosure
- **Server-status / management consoles** (/server-status, /server-info, /jenkins/script, /actuator/*) — multiple H1 2026 reports
- **Cloud storage buckets** (S3, GCS, Azure Blob, OSS, R2 — by name guessing or subdomain enum) — ESHYFT-class
- **API responses with verbose fields** (`/users/{id}` returning password_hash, internal_notes, role, tokens) — over-fetching pattern
- **Background-job logs** (Sidekiq, Celery, BullMQ admin UI exposing job arguments) — credential leakage in job params
- **Browser-side: JS bundles, Service Workers, source maps** (`.map` files, `__webpack_require__` exposing module names) — secrets in client-side
- **Mobile app binaries** (APK reverse-engineering, IPA Mach-O strings, embedded URLs and API keys)
- **Memory dumps** (heapdump, core dumps, profiler output, browser tab snapshots) — Volkswagen Spring actuator pattern
- **Process command lines** (/proc/PID/cmdline, /debug/pprof/cmdline, ps output) — Dgraph GHSA-95mq-xwj4-r47p
- **DNS records** (TXT records exposing internal service names, SPF records exposing service vendors, CNAME chains)
- **Headers** (Server, X-Powered-By, X-AspNet-Version, X-Framework, custom internal-name headers)
- **Email headers and bounces** (Received chains exposing internal mail server names, NDR responses leaking user existence)
- **Webhooks / callback URLs** (test webhook endpoints exposing internal service URLs in retry logs)
- **CORS preflight responses** (Access-Control-Allow-Origin reflecting attacker origin reveals trusted-origin allowlist)
- **Sitemap, robots.txt** (admin paths, dev environment URLs, staging hostnames)
- **Public-by-design APIs accidentally returning private fields** — over-fetching, GraphQL field-level (cross-references hunt-idor and hunt-xss)
- **Enumeration endpoints** — different responses for existing vs non-existing user/email/UUID enable username harvesting (MinIO LDAP GHSA-jv87-32hw-hh99 pattern)
- **Cache headers leaking auth state** (`X-Cache: HIT` / `Vary` mismatches reveal authenticated content cached publicly)

For each surface, send: `curl -sI https://target/<path>` (header inspection), `curl -s https://target/<path> | head -100` (body inspection), `curl -s -X POST -H "Content-Type: application/json" -d '{}' https://target/<endpoint>` (error elicitation), and run `nuclei -t exposures/` against the host for the canonical exposure templates.

## Step-by-Step Hunting Methodology

1. **Subdomain enumeration first.** `subfinder + amass + chaos + crt.sh` → every subdomain. Each is a candidate for `.git/`, `.env`, `/actuator/`, `/server-status`. The exposed-config attack surface scales linearly with subdomain count; legacy / dev / staging subdomains are the highest-yield targets.

2. **Run nuclei `exposures/` template set on every subdomain.** `nuclei -t http/exposures/` covers `.git/HEAD`, `.env`, `/server-status`, `/actuator/*`, `/swagger.json`, `/.well-known/`, `/phpinfo`, hundreds more. Single command, ~30 seconds per host. The H1 2026 wp-config disclosures (reports 3328408, 3252302) and `/server-status` disclosure (2473173) are all canonical nuclei-template hits.

3. **Spring Boot Actuator deep-probe.** If host responds with `Server:` containing Tomcat/Jetty/Undertow OR `X-Application-Context:` header OR `/actuator/health` returns 200 — probe the full endpoint set with priority ordering: `/actuator/heapdump` (CRITICAL — full memory dump), `/actuator/env` (HIGH — env vars), `/actuator/configprops`, `/actuator/beans`, `/actuator/threaddump`, `/actuator/mappings`, `/actuator/loggers`, `/actuator/gateway/routes` (CVE-2025-41243). For `/actuator/heapdump`, download the binary, analyze with Eclipse Memory Analyzer (MAT) or `strings | grep -E 'AKIA|AIza|sk_live|ghp_'` for secret patterns.

4. **`.env` and `.git/` direct probe on every subdomain.** `curl -s https://target/.env` and `curl -s https://target/.git/HEAD`. If 200 OK with content, run `git-dumper https://target/.git/ /tmp/dumped` to recover the entire repo. Then `trufflehog filesystem /tmp/dumped --only-verified` to extract live credentials.

5. **`wp-config.php` and backup-file fuzzing.** Use `ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -u https://target/FUZZ -mc 200`. Append common backup extensions: `wp-config.php{,.bak,.old,~,.swp,.swo,.copy,.backup}`. The H1 2026 wp-config reports came from this exact technique against forgotten subdomains.

6. **Source-code repo secret scanning.** For OSS targets and any program with GitHub presence in scope: `trufflehog github --org=<org> --only-verified` (uses 800+ detectors with active credential validation). Cross-check with `gitleaks` on cloned repos. Reference TruffleHog: https://github.com/trufflesecurity/trufflehog. Caveat: most bug bounty programs classify credential exposure as out-of-scope; check program policy first (see Cremit Ap