hunt-source-leak

> **⚠️ AUTHORIZED USE ONLY**

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

# HUNT-SOURCE-LEAK — Source Code & Build Artifact Leakage

Crown Jewel Targets

Source map exposing TypeScript source = see all API routes, auth logic, secrets. Swagger/OpenAPI JSON = complete API surface map.

**Highest-value findings:**

- **`.js.map` source maps** — reconstruct full TypeScript/ES6 source code → find hardcoded API keys, internal endpoints, auth logic bypasses

- **`swagger.json` / `openapi.json`** — complete REST API specification with all endpoints, parameters, auth schemes, and internal route names

- **`.env` / `.env.production`** — APP_KEY, DB_PASSWORD, API_KEY, SECRET_KEY in plaintext

- **`.git/` exposure** — `git clone` the entire source history → all past hardcoded secrets

- **`asset-manifest.json` / `_next/static/`** — all JS bundle paths → systematic source map discovery

- **`build-info` / `info.json`** — git commit hash, build timestamp, dependency versions → CVE targeting

---

Phase 1 — Quick Wins (Run First)

# These 10 requests take <30 seconds and often yield Critical findings
for PATH in \
  "/.env" \
  "/.env.production" \
  "/.env.local" \
  "/.git/HEAD" \
  "/swagger.json" \
  "/api/swagger.json" \
  "/v1/swagger.json" \
  "/openapi.json" \
  "/api/openapi.json" \
  "/api-docs"; do
  STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$PATH")
  if [ "$STATUS" = "200" ]; then
    echo "[+] HIT: https://$TARGET$PATH"
    head -5 /tmp/sl_test
    echo "---"
  fi
done

---

Phase 2 — Source Map Discovery

> **Always resolve the CURRENT build hash before testing, and again before

> re-verifying.** Bundle filenames are content-hashed, so they rotate on every

> deploy. A `.map` URL recorded yesterday can 404 today while the map is still

> fully exposed under a new name. **A 404 at the old URL is not remediation** —

> it is a new build.

>

> ```bash

> # ALWAYS derive the hash live, never reuse a recorded URL

> HASH=$(curl -s "https://$TARGET/" | grep -oE 'main\.[a-f0-9]+\.js' | head -1)

> curl -s -o /dev/null -w '%{http_code} %{size_download} %{content_type}\n' \

> "https://$TARGET/static/js/${HASH}.map"

> ```

>

> **Lesson from an authorized engagement.** A large production map was found at

> `main.<hashA>.js.map`. On re-verification that URL returned a small HTML

> soft-404 and the finding was nearly closed as fixed. The bundle had rotated to

> `main.<hashB>.js` — and the map was still published at `main.<hashB>.js.map`,

> same size. Nothing had been remediated.

>

> Tell the client this explicitly in the report: **redeploying does not fix source

> map exposure.** Only `GENERATE_SOURCEMAP=false` (or stripping `.map` at deploy)

> plus a CDN purge closes it. A team that redeploys and re-checks the old link

> will wrongly declare victory.

>

> Same rule applies to any content-hashed artifact: chunk files, CSS maps,

> `asset-manifest.json`, and staging equivalents.

# Step 1: Get asset manifest to find all JS bundle paths
curl -s "https://$TARGET/asset-manifest.json" | python3 -m json.tool 2>/dev/null
curl -s "https://$TARGET/static/js/main.*.js" 2>/dev/null | head -3

# Next.js
BUILD_ID=$(curl -s https://$TARGET/ | grep