Source Leak Hunt Skill

Mass scanning for exposed sensitive files (.env, .git/config, wp-config.php.bak, debug.log, backup.sql, phpinfo.php, Dockerfile, etc.) with content-based false positive filtering. Source leaks are the second most common finding (~7% of targets) after WordPress user enumeration.

When to Use

• After skill_view(name='wp-mass-recon') confirms a target is alive.
• Broad scanning across a batch of domains.
• When probing for credential exposure that enables deeper access.
• Complementing skill_view(name='js-secrets-extraction') for client-side secrets.

Prerequisites

• terminal with curl.
• List of live URLs (output from httpx or wp-mass-recon Phase 1).
• Persistence: output directory at $OUTDIR/leaks/.

How to Run