source-leak-hunt

1# Source Leak Hunt Skill
2 
3Mass scanning for exposed sensitive files (`.env`, `.git/config`, `wp-config.php.bak`, `debug.log`, `backup.sql`, `phpinfo.php`, `Dockerfile`, etc.) with content-based false positive filtering. Source leaks are the second most common finding (~7% of targets) after WordPress user enumeration.
4 
5## When to Use
6 
7- After `skill_view(name='wp-mass-recon')` confirms a target is alive.
8- Broad scanning across a batch of domains.
9- When probing for credential exposure that enables deeper access.
10- Complementing `skill_view(name='js-secrets-extraction')` for client-side secrets.
11 
12## Prerequisites
13 
14- `terminal` with curl.
15- List of live URLs (output from httpx or wp-mass-recon Phase 1).
16- Persistence: output directory at `$OUTDIR/leaks/`.
17 
18## How to Run
19 
20```bash
21# Quick scan single target (20 paths)
22TARGET="https://example.com"
23for path in .env .git/config wp-config.php.bak debug.log backup.sql info.php phpinfo.php \
24  .env.backup .env.local .env.production wp-config.php~ .git/HEAD .backup.sql \
25  docker-compose.yml Dockerfile .DS_Store robots.txt sitemap.xml; do
26  code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 --connect-timeout 5 "$TARGET/$path")
27  [[ "$code" == "200" ]] && echo "HTTP 200: $TARGET/$path"
28  sleep 0.2
29done
30```
31 
32## Quick Reference
33 
34| Path | What It Exposes | Severity |
35|------|----------------|----------|
36| `.env` | DB creds, API keys, app secrets | Critical |
37| `wp-config.php.bak` | MySQL root password, salts | Critical |
38…