| name | information-disclosure |
| description | Version-control and backup exposure (.git/.svn/.hg dumps), API/debug endpoint leaks (Swagger, source maps, actuator heapdumps), cloud metadata and datastore exposure (AWS/GCP/Firebase/Mongo/Redis/Elasticsearch), secrets scanning, and user/UUID enumeration oracles. Converted from master-pentest-prompt.md Phase 13. Use during recon and throughout the engagement whenever a new endpoint or exposed path is found. |
Information disclosure
When to use
Recon-time and continuously -- new endpoints found in later phases are
worth re-checking against this list, not just the initial pass.
Exposed source / version control
.git/.svn/.hg exposure (git-dumper-style reconstruction), exposed
.env, backup files, old/forgotten deployments left reachable.
API and debug surfaces
Swagger/OpenAPI docs, JS source maps, Spring Boot Actuator heapdumps
(/actuator/heapdump alongside /env), debug endpoints, stack traces,
verbose error messages.
Cloud and datastore exposure
AWS metadata endpoint, GCP service-account credentials/cloud functions,
Firebase read access, open Firestore rules, exposed Mongo/Redis/
Elasticsearch instances with no auth.
Secrets
TruffleHog-style scanning of public repos, S3 object enumeration, JS
credential scanning for aws:Cognito, google:apiKey, sentry:dns,
Firebase config -- secrets-mcp automates the local-file version of this
scan once files are downloaded.
Enumeration oracles
- User enumeration: login timing differences, different response
bodies, forgot-password message differences between valid and invalid
accounts.
- UUID/GUID enumeration: prediction via date-based or base64-encoded
generation patterns rather than assuming UUIDs are unguessable.
