Information Disclosure
Information disclosure occurs when an application fails to properly protect sensitive information, giving users access to information they shouldn't have available to them. This sensitive information can include technical details that aid an attack, like software version numbers, internal IP addresses, sensitive filenames, and filepaths.
Hunt for information disclosure
- Look for software version numbers and configuration information by using recon techiques.
- Start searching for exposed configuration files, database files, and other sensitive file uploaded to the production server that aren't protected properly. Techniques you can use include path traversal, scraping the Wayback Machines or paste dump site, and looking for files in exposed .git directories.
- Find information in the application's public files, such as its HTL and JavaScript source code, by grepping the file with keywords.
- Consider the impact of the information you find before reporting it, and explore ways to escalate its impact.