hunt-source-leak

# HUNT-SOURCE-LEAK — Source Code & Build Artifact Leakage ## Crown Jewel Targets Source map exposing TypeScript source = see all API routes, auth logic, secrets. Swagger/OpenAPI JSON = complete API surface map. **Highest-value findings:** - **`.js.map` source maps** — reconstruct full TypeScript/ES6 source code → find hardcoded API keys, internal endpoints, auth logic bypasses - **`swagger.json` / `openapi.json`** — complete REST API specification with all endpoints, parameters, auth schemes, and internal route names - **`.env` / `.env.production`** — APP_KEY, DB_PASSWORD, API_KEY, SECRET_KEY in plaintext - **`.git/` exposure** — `git clone` the entire source history → all past hardcoded secrets - **`asset-manifest.json` / `_next/static/`** — all JS bundle paths → systematic source map discovery - **`build-info` / `info.json`** — git commit hash, build timestamp, dependency versions → CVE targeting --- ## Phase 1 — Quick Wins (Run First) ```bash # These 10 requests take <30 seconds and often yield Critical findings for PATH in \ "/.env" \ "/.env.production" \ "/.env.local" \ "/.git/HEAD" \ "/swagger.json" \ "/api/swagger.json" \ "/v1/swagger.json" \ "/openapi.json" \ "/api/openapi.json" \ "/api-docs"; do STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$PATH") if [ "$STATUS" = "200" ]; then echo "[+] HIT: https://$TARGET$PATH" head -5 /tmp/sl_test echo "---" fi done ``` --- ## Phase 2 — Source Map Discovery ```b...