hunt-information-disclosure

name	hunt-information-disclosure
description	Hunt error leakage, DVCS exposure, source maps, config files, and differential oracles.
category	redteam
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3, httpx
tags	["redteam","information-disclosure","error-leakage","source-maps","config","enumeration"]
related_skills	["source-leak-hunt","js-secrets-extraction","error-log-mining","web-enumeration"]

Information Disclosure Hunting

Hunt for information exposure through stack traces, debug endpoints, versioned path discovery, source maps, and differential oracles. Each disclosure amplifies other vulnerabilities — a version number enables CVE targeting, a server path enables LFI, a schema leak enables auth bypass, and an error message reveals internal infrastructure.

When to Use

• Applications return verbose error messages with stack traces, file paths, or SQL fragments.
• Source maps (.js.map) are deployed to production.
• Versioned static assets reveal framework/CMS versions.
• API responses differ by object existence (user enumeration by status/length/time).
• Debug endpoints, health checks, or status pages expose internal state.

Quick Detection

# Trigger errors on common paths
for path in "/nonexistent" "/%00" "/.." "/error" "/debug"; do
  curl --max-time 30 --connect-timeout 10 -sk "https://target.com$path" | grep -iE "stack|trace|exception|error|warning|debug|line [0-9]+" | head -5
done

Procedure

Phase 1 — Error & Exception Leakage

# Trigger errors with malformed input
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users?id='"
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/login" -d '{"username":null}'
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/search?q=%00"

# Check response for sensitive data
# Stack traces → file paths, line numbers, framework version
# SQL errors → table names, column names, DB type
# Deserialization errors → class names, serialization format
# Template errors → template paths, engine type

# Fuzz for debug endpoints
for path       \
               ; 
  curl --max-time 30 --connect-timeout 10 -sk  -w  -o /dev/null