testing-for-sensitive-data-exposure

# Testing for Sensitive Data Exposure ## When to Use - During authorized penetration tests when assessing data protection controls - When evaluating applications for GDPR, PCI DSS, HIPAA, or other data protection compliance - For identifying leaked API keys, credentials, tokens, and secrets in application responses - When testing whether sensitive data is properly encrypted in transit and at rest - During security assessments of APIs that handle PII, financial data, or health records ## Prerequisites - **Authorization**: Written penetration testing agreement with data handling scope - **Burp Suite Professional**: For intercepting and analyzing responses for sensitive data - **trufflehog**: Secret scanning tool (`pip install trufflehog`) - **gitleaks**: Git repository secret scanner (`go install github.com/gitleaks/gitleaks/v8@latest`) - **curl/httpie**: For manual endpoint testing - **Browser DevTools**: For examining local storage, session storage, and cached data - **testssl.sh**: TLS configuration testing tool ## Workflow ### Step 1: Scan for Secrets in Client-Side Code Search JavaScript files, HTML source, and other client-side resources for exposed secrets. ```bash # Download and search JavaScript files for secrets curl -s "https://target.example.com/" | \ grep -oP 'src="[^"]*\.js[^"]*"' | \ grep -oP '"[^"]*"' | tr -d '"' | while read js; do echo "=== Scanning: $js ===" # Handle relative URLs if [[ "$js" == /* ]]; then curl -s "https://targe...