Information Disclosure
Exposed Internal Information
0 / 4 solved
Find sensitive details leaked through errors, forgotten files, metadata, and deployment artifacts.
Quick reference
Information disclosure cheat sheet
Look for information the application accidentally makes public even though it is not intended as a user-facing feature.
Where to look
- Verbose errors, stack traces, debug pages, response headers, comments, API error bodies, and environment banners.
- robots.txt, sitemap files, backup files, editor swap files, archives, old configs, source maps, and public storage buckets.
- JavaScript bundles and .map files for internal routes, feature flags, API hostnames, and accidentally embedded secrets.
Simple checks
- Trigger harmless invalid input and compare normal vs error responses.
- Request common public metadata files and inspect referenced assets.
- Search downloaded JavaScript/source maps for words like internal, admin, token, key, debug, staging, backup.
/robots.txt/config.json.bak/assets/app.js.mapRealistic tips
- A disclosed route is not automatically a vulnerability if access control still protects it.
- Internal hostnames, versions, paths, and usernames can still materially help later testing even when no password is leaked.
- Separate debug diagnostics from production responses and keep backups outside the web root.