detecting-exposed-secrets-files
Detecting Exposed Secrets Files
Overview
The single highest-value pentest probe per HTTP request. A .git/config
disclosure leaks repo URL + credentials embedded in remote URLs. A .env
disclosure leaks every API key the app has. A backup.sql disclosure
leaks the entire database. These are not "weak crypto" findings that need
a chained exploit. They are direct, immediate compromise.
The probe set is the canonical 40+ paths web servers commonly expose by
accident: VCS directories (.git/, .svn/, .hg/), dotenv files,
OS metadata (.DS_Store), database dumps, archive files, IDE configs,
CI configs, and key files. Each is fingerprinted to distinguish a true
positive (server returns the file's expected content) from a 200 OK
that's actually the application's SPA index page catching the route.