| name | detecting-exposed-secrets-files |
| description | Probe a target for accidentally-served secret-bearing files in the web root
— .git/, .env, .DS_Store, backup files, database dumps, key files,
CI configs, IDE configs.
Use when: post-deploy verification on a new release, or SOC2 auditor asked
"what's reachable in the web root that shouldn't be," or a bug-bounty
report hints at a leaked file.
Threshold: any of the canonical 40+ paths returns 200 OR returns a body
matching the expected fingerprint of the file type (e.g., .git/HEAD
returns content starting with ref: or a 40-char hex SHA).
Trigger with: "check exposed files", "git directory exposure",
"env file leak", "backup file scan".
|
| allowed-tools | ["Read","Bash(python3:*)","Bash(curl:*)"] |
| disallowed-tools | ["Bash(rm:*)","Edit(/etc/*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","information-disclosure","secrets","pentest"] |
Detecting Exposed Secrets Files
Overview
The single highest-value pentest probe per HTTP request. A .git/config
disclosure leaks repo URL + credentials embedded in remote URLs. A .env
disclosure leaks every API key the app has. A backup.sql disclosure
leaks the entire database. These are not "weak crypto" findings that need
a chained exploit. They are direct, immediate compromise.
The probe set is the canonical 40+ paths web servers commonly expose by
accident: VCS directories (.git/, .svn/, .hg/), dotenv files,
OS metadata (.DS_Store), database dumps, archive files, IDE configs,
CI configs, and key files. Each is fingerprinted to distinguish a true
positive (server returns the file's expected content) from a 200 OK
that's actually the application's SPA index page catching the route.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
.git/HEAD reachable + valid content | CRITICAL | 200 + body matches ref: or 40-char SHA | NIST 800-53 SC-28 |
.git/config reachable + repo URL leaked | CRITICAL | 200 + body matches [remote | NIST 800-53 SC-28 |
.env reachable + dotenv format | CRITICAL | 200 + body matches KEY=VALUE lines | OWASP A05:2021 |
*.sql / *.dump / backup.* reachable | CRITICAL | 200 + body looks like SQL or binary dump | CWE-538 |
.aws/credentials reachable | CRITICAL | 200 + body matches [default]\naws_access_key_id | CWE-200 |
id_rsa / *.pem / *.key reachable | CRITICAL | 200 + body matches BEGIN PRIVATE KEY or BEGIN RSA |
