hunt-information-disclosure

name	hunt-information-disclosure
description	Hunt error leakage, DVCS exposure, source maps, config files, and differential oracles.
category	redteam
version	1.0.0
author	uphiago
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3, httpx
metadata	{"tags":["redteam","information-disclosure","error-leakage","source-maps","config","enumeration"],"category":"redteam","related_skills":["hunt-source-leak","js-secrets-extraction","error-log-mining","web-enumeration"]}

Information Disclosure Hunting

Hunt for information exposure through stack traces, debug endpoints, versioned path discovery, source maps, and differential oracles. Each disclosure amplifies other vulnerabilities — a version number enables CVE targeting, a server path enables LFI, a schema leak enables auth bypass, and an error message reveals internal infrastructure.

When to Use

• Applications return verbose error messages with stack traces, file paths, or SQL fragments.
• Source maps (.js.map) are deployed to production.
• Versioned static assets reveal framework/CMS versions.
• API responses differ by object existence (user enumeration by status/length/time).
• Debug endpoints, health checks, or status pages expose internal state.

Quick Detection

# Trigger errors on common paths
for path in "/nonexistent" "/%00" "/.." "/error" "/debug"; do
  curl -sk "https://target.com$path" | grep -iE "stack|trace|exception|error|warning|debug|line [0-9]+" | head -5
done

Procedure

Phase 1 — Error & Exception Leakage

# Trigger errors with malformed input
curl -sk "https://target.com/api/users?id='"
curl -sk -X POST "https://target.com/api/login" -d '{"username":null}'
curl -sk "https://target.com/search?q=%00"

# Check response for sensitive data
# Stack traces → file paths, line numbers, framework version
# SQL errors → table names, column names, DB type
# Deserialization errors → class names, serialization format
# Template errors → template paths, engine type

# Fuzz for debug endpoints
for path in "/debug" "/__debug__"    \
               ; 
  curl -sk  -w  -o /dev/null