hunt-info-disclosure

Crown Jewel Targets

Information disclosure is the most-volume bug class in bug bounty (~30% of all disclosed reports across H1/Bugcrowd hacktivity), but the paying surface has shifted decisively toward systemic credential exposure rather than one-off PII leaks. Reflected stack traces on a 404 page are mid-three-figure or N/A on most programs; an exposed /actuator/heapdump containing AWS keys is mid-five-figure-class because it cascades to RCE on production cloud infrastructure. The 24-month meta crystallized around seven asset types. All CVEs below are NVD-verified.

1. Spring Boot Actuator exposure (mid four-figure to mid five-figure when chained to cloud takeover). Wiz Threat Research Dec 2024 analysis: 60% of cloud environments use Spring Boot Actuator, 11% expose instances publicly to the internet, 24% of exposed instances are misconfigured. Volkswagen 9TB GPS data disclosure — single open /actuator/heapdump endpoint provided plaintext AWS keys via heap dump, attackers downloaded 9 TB of GPS data from hundreds of thousands of cars. Reference: https://www.syscrest.com/2025/02/securing-spring-boot-actuator/ (SYSCREST analysis Feb 2025), https://www.cyberkendra.com/2024/12/vulnerability-in-spring-boot-actuator.html (Wiz research summary Dec 2024). NVD-verified CVEs in the family:

• CVE-2025-41243 Spring Cloud Gateway Server Webflux property modification (CVSS 10.0 CRITICAL) — when actuator gateway endpoint exposed via management.endpoints.web.exposure.include=gateway, attackers modify Spring Environment properties remotely → potential RCE. Affects 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.1.x. Fix in 4.3.1 / 4.2.5 (OSS); 4.1.11 / 3.1.11 (Enterprise).
• CVE-2025-41253 Spring Cloud Gateway info-disclosure (CVSS 7.5 HIGH) — SpEL injection on actuator endpoint exposes environment variables and system properties (DB credentials, API keys, internal URLs).
• CVE-2025-22235 Spring Boot EndpointRequest.to() wrong matcher (CVSS 7.3 HIGH) — disabled actuator endpoint creates unprotected /null/** matcher path.
• CVE-2025-8525 Exrick xboot Spring Boot Admin/Actuator info disclosure (CVSS 5.5 MEDIUM).
• CVE-2025-8738 zlt2000 microservices-platform actuator interface (CVSS 5.5 MEDIUM).

The Wiz dashboard checklist for actuator endpoints: /health (low), /prometheus /metrics (medium), /env (HIGH — never expose), /heapdump (CRITICAL — never expose), /beans /mappings /loggers (high — internal/auth only), /shutdown (HIGH — disabled by default, never enable).

2. .git/ and .env mass exposure (mid four-figure direct + supply-chain cascades). Two large 2024-2025 disclosures show this is industrialized:

• Sysdig EmeraldWhale Oct 2024 — automated scanning of IP ranges for exposed /.git/config files. Stole 15,000 cloud credentials from 67,000 URLs (28K Git repos, 6K GitHub tokens, 2K validated active credentials). Stored stolen secrets in 1TB S3 bucket. Reference: https://sysdig.com/blog/emeraldwhale, https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/.
• Unit42 (Palo Alto) Aug 2024 — large-scale .env extortion campaign scanned 110,000 domains, identified 90,000 unique combos of leaked env-vars including 7,000 active AWS access keys. Targeted Mailgun-mentioning .env files for legitimate-domain phishing. Reference: https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation.

Pattern: web servers serving Laravel, Symfony, Rails, Django apps mistakenly serve the application root including .env and .git/. Hunt with: curl -s https://target/.env, curl -s https://target/.git/config, curl -s https://target/.git/HEAD. Then git-dumper https://target/.git/ /tmp/dumped to recover the full repo.

Disclosed bug bounty cases: NASA _x3ro_ Bugcrowd disclosure (Aug 2025, P3) — publicly accessible .env on NASA Bitbucket exposed UAT credentials for cmr.sit.earthdata.nasa.gov. Reference: https://redpacketsecurity.com/bugcrowd-bugbounty-disclosure-publicly-accessible-env-file-exposing-hardcoded-credentials-on-nasa-s-git-repository.

3. Source-code repository secret leakage (CWE-798, low five-figure on triage-friendly programs). GitGuardian 2026 State of Secrets Sprawl: 28.65M new hardcoded secrets added to public GitHub repos in 2025 (34% YoY increase). GitHub's own 2024 secret-scanning report: 39M secret leaks. IEEE S&P 2025 academic study: up to 30% of projects at risk. Starbucks H1 #716292 (2019, Cremit reference) — single leaked JumpCloud API key in public GitHub repo, classified CWE-798, CVSS 9.7 critical, paid bounty — proof that bug bounty programs CAN treat credential exposure as paying class. Reference: https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure (Apr 2026 Cremit research on this exact pattern).

Hunt with TruffleHog (https://github.com/trufflesecurity/trufflehog, 26K+ stars, 800+ detectors, active credential verification against provider APIs to confirm still-live keys). Same pattern via GitGuardian, Snyk Code SAST, GitHub Secret Scanning. Caveat from Cremit Apr 2026 analysis: most bug bounty programs still classify credential exposure as out-of-scope — check program scope before reporting; many specifically EXCLUDE this finding class.

4. Cloud-bucket misconfig (S3, GCS, Azure Blob — mid four-figure when PII counted; informational P5 when generic). ESHYFT March 2025 — 108GB / 86,341 healthcare-worker records (medical IDs, drivers licenses, SSNs, prescription records, disability claims) in unsecured S3 bucket; researcher Jeremiah Fowler discovered, took >1 month for org to close. Reference: https://www.theregister.com/2025/03/11/uber_for_nurses_exposes_86k/. NASA Bugcrowd disclosure Feb 2025 — PDF in public S3 bucket (P5 informational only — NASA's VDP triages cloud-bucket findings strictly). Reference: https://bugcrowd.com/disclosures/aa45924f-8b67-4f22-8dff-dac7dc9d60e2/exposure-of-pdf-file-in-a-public-amazon-s3-bucket-associated-with-nasa.

Hunt with s3scanner, AWSBucketDump, subdomain enumeration → <name>.s3.amazonaws.com, <name>.blob.core.windows.net, <name>.storage.googleapis.com. The Wiz Cloud Security Index annual report tracks the most-common misconfig classes.

5. Debug endpoint family (Spring actuator, Go pprof, Glances, FUXA, NetBird, Harbor — low four-figure to low five-figure depending on what's exposed). All NVD-verified or GHSA-verified, all 2025-2026:

• Dgraph /debug/pprof/cmdline (GHSA-95mq-xwj4-r47p) — unauthenticated debug endpoint exposes full process command line including admin token from --security "token=...". Critical.
• Glances /api/4/serverslist (GHSA-r297-p3v4-wp8m, GHSA-gfc2-9qmw-w7vh) — Central Browser mode REST API returns raw server objects with reusable downstream credentials; permissive CORS allows any origin.
• FUXA plaintext DB credentials (GHSA-c5gq-4h56-4mmx) — unauthenticated remote attacker retrieves administrative database credentials.
• Harbor default password (GHSA-hj7x-hmf2-hc2p) — GoHarbor v2.15.0 and below allows default password for web UI login.
• NetBird VPN (GHSA-g3j4-58mp-3x25) — installation script fails to remove ZITADEL-created default admin password.
• MinIO LDAP brute-force (GHSA-jv87-32hw-hh99) — AssumeRoleWithLDAPIdentity STS endpoint vulnerable to brute-forcing due to user enumeration + missing rate limit.
• PraisonAI WebSocket Gateway (GHSA-cfh6-vr3j-qc3g) — /ws and /info endpoints serve agent topology with no auth; any network client can connect, enumerate registered agents.
• Gradio ACL bypass (GHSA-j2jg-fq62-7c3h) — file path ACL bypassed via case alteration; lack of case normalization.
• Rancher cluster template credentials in answers — credentials not properly sanitized.
• ArgoCD Redis cache risky/missing crypto — credentials cached without proper encryption.
• /server-status Apache mod_status endpoint — H1 report 2473173 (2026 High) — exposed at https://203.137.128.240/server-status leaks request URLs, IPs, vhosts.

6. PII exposure via API misconfiguration (CVSS-Confidentiality-only, low four-figure to low five-figure depending on record count). Recent disclosed examples:

• ASBS soldiers PII (H1 2026 critical) — viewing other soldiers' Personnel Information / Board / Board Voters via the Army Body Score System.
• /talos/api/v1/files/upload Critical Information Disclosure (H1 report 3228011, 2025 critical).
• IBM Aspera HTTP Gateway (H1 report 3340797, 2026 high) — sensitive information stored in clear text in easily obtainable files.
• ORDER_ERROR_LOG PII Data Exposure (H1 2026 high) — error-log endpoint returns PII for any order ID.
• Session Cookie Leakage via Static Header Field in WebViewerFragment (H1 2026 high) — mobile WebView leaks session via static header.

Hunt: every API endpoint that returns user data, every error/log endpoint, every export feature, every /me and /users/{id} route.

7. WordPress wp-config.php exposure (mid three-figure to mid four-figure; reliable VDP filler). Multiple H1 reports 2026: report 3328408 (National Guard website), report 3252302. Pattern: .bak, .old, ~, .swp backup files served alongside wp-config.php containing DB credentials. Hunt with: curl https://target/wp-config.php{,.bak,.old,~,.swp}. The BackupFinder ffuf wordlist covers the common variants.

Memory disclosure (Heartbleed-class, when found pays mid five-figure). Dgraph /debug/pprof/cmdline above. .NET Framework ObjRefs Disclosure (CVE-2024-29059) — H1 2026 high — .NET Remoting ObjRefs reveal internal endpoints. Modern memory-disclosure findings rare but high-impact when chained.

Mobile / game / IoT disclosure — ASLR leak in Mario Kart World through LAN mode (H1 2026 high). Mobile-app reverse-engineering finds API keys, internal URLs in compiled binaries. Game-engine memory disclosure via LAN/multiplayer protocols.

What pays the most: Spring actuator heapdump → cloud takeover (mid five-figure when chained — Volkswagen-class). Source-code repo with active AWS keys (low five-figure on programs that accept the class — Starbucks H1 #716292 precedent). Mass-PII via API misconfig (mid four-figure × record-count multiplier on healthcare/financial). .env exposure with active credentials (low four-figure direct + chain to AWS infrastructure for upgrade). .git/ exposure (low four-figure direct + recover full repo + extract secrets). Generic stack trace, version banners, README leak — N/A on most programs.

Attack Surface Signals

Greppable signals that this surface might exist:

# Spring Boot Actuator endpoints (CVE-2025-41243 family + Volkswagen pattern)
rg -n -e 'management\.endpoints\.web\.exposure\.include' \
   -e 'spring-boot-starter-actuator' \
   -g 'application*.{yml,yaml,properties}' -g '*.gradle' -g 'pom.xml'

# Spring actuator endpoints exposed in code
rg -n -e '@Endpoint' -e '@WebEndpoint' -e '@ReadOperation' --type java

# Hardcoded secrets / credentials in source
rg -n -e 'AKIA[0-9A-Z]{16}' \
   -e 'AIza[0-9A-Za-z_-]{35}' \
   -e 'sk_live_[0-9a-zA-Z]{24,}' \
   -e 'ghp_[0-9a-zA-Z]{36}' \
   -e 'github_pat_[0-9a-zA-Z]{82}' \
   -e 'xox[bpoa]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}' \
   -e 'eyJhbGciO[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' \
   -g '!*.lock' -g '!node_modules' -g '!vendor'

# Database connection strings
rg -n -i -e 'jdbc:(?:mysql|postgresql|mariadb|oracle|mssql)://[^"\s]*:[^@\s]+@' \
   -e 'mongodb(\+srv)?://[^"\s]*:[^@\s]+@' \
   -e 'redis://[^"\s]*:[^@\s]+@' \
   -e 'amqp://[^"\s]*:[^@\s]+@'

# .env file references in code (suggest .env exists in deploy)
rg -n -e 'process\.env\.\w+' -e 'os\.environ\[' -e 'env\(\'?\w+\'?\)' \
   --type js --type ts --type py --type php

# Debug / pprof endpoints in Go code
rg -n -e 'net/http/pprof' -e '"/debug/pprof"' -e '_pprof' --type go

# Verbose error / debug mode in framework configs
rg -n -i -e 'debug\s*=\s*true' -e 'app_debug=true' \
   -e 'DEBUG\s*:\s*True' -e 'DJANGO_DEBUG=True' \
   -g '*.{yml,yaml,toml,ini,env,properties}'

# Stack-trace exposure in error handlers (Express/Flask)
rg -n -e 'app\.use\(function\(err' -e 'errorhandler\(' \
   -e '@app\.errorhandler' -e 'send.*error\.stack' \
   --type js --type ts --type py

HTTP-level signals on a live target:

• Server: Tomcat, X-Application-Context:, Server: Jetty + /actuator/health returns 200 → Spring Boot Actuator surface (probe /actuator/heapdump, /actuator/env, /actuator/beans)
• Server: Apache + Apache mod_status enabled → /server-status info disclosure (H1 report 2473173, 2026 High)
• X-Powered-By: PHP/X.Y.Z + phpinfo() reachable at common paths → CVE-class info disclosure
• X-Powered-By: ASP.NET, .NET Remoting enabled → CVE-2024-29059 .NET Framework ObjRefs disclosure family
• Subdomain returns Laravel default page → probe https://target/.env directly
• Any 200 OK on https://target/.git/HEAD or https://target/.git/config → .git/ exposure (Sysdig EmeraldWhale class)
• Vary: Accept-Encoding + text/html response on https://target/wp-config.php{,.bak,.old,~} → WordPress wp-config exposure (H1 reports 3328408, 3252302, 2026 High)
• Open <bucket>.s3.amazonaws.com, <bucket>.blob.core.windows.net, <storage>.googleapis.com returns XML directory listing → S3 / Azure / GCS bucket misconfig (ESHYFT-class)
• /api/v1/info, /api/4/serverslist, /info, /version, /build-info returning verbose data → Glances-class (GHSA-r297-p3v4-wp8m)
• /debug/pprof/cmdline returns process command line including secrets → Dgraph-class (GHSA-95mq-xwj4-r47p)
• Login page returning different responses for valid vs invalid usernames → user enumeration surface (MinIO GHSA-jv87-32hw-hh99 LDAP variant)
• /swagger.json, /api-docs, /openapi.json, /.well-known/openapi exposed in production → API documentation exposure
• 500 error response includes full stack trace, file paths, framework version → stack-trace info disclosure
• WWW-Authenticate: Basic realm="..." exposing internal app names → internal hostname disclosure
• Set-Cookie: <SESSION>=<value>; Domain=.target.com; Path=/ (no Secure, no HttpOnly) → session-cookie leakage surface

Insertion Point Taxonomy

Every place sensitive content leaks for info-disclosure:

• Source-code repos (.git/.svn/.hg directories served by web server, public GitHub repos with embedded secrets, leaked private repo via dependency) — Sysdig EmeraldWhale 2024
• Configuration files (.env, wp-config.php, web.config, application.properties, settings.py, config.json) — Unit42 110K-domain scan 2024
• Backup files (.bak, .old, ~, .swp, .swo, .DS_Store, _bak, .backup, .copy) — manual fuzzing target
• Debug / health / actuator endpoints (/actuator/, /debug/pprof/, /api/health, /api/info, /api/build-info) — Wiz Threat Research 2024
• Error pages / stack traces (any 500 / 404 / unhandled exception) — framework-version + path disclosure
• Server-status / management consoles (/server-status, /server-info, /jenkins/script, /actuator/*) — multiple H1 2026 reports
• Cloud storage buckets (S3, GCS, Azure Blob, OSS, R2 — by name guessing or subdomain enum) — ESHYFT-class
• API responses with verbose fields (/users/{id} returning password_hash, internal_notes, role, tokens) — over-fetching pattern
• Background-job logs (Sidekiq, Celery, BullMQ admin UI exposing job arguments) — credential leakage in job params
• Browser-side: JS bundles, Service Workers, source maps (.map files, __webpack_require__ exposing module names) — secrets in client-side
• Mobile app binaries (APK reverse-engineering, IPA Mach-O strings, embedded URLs and API keys)
• Memory dumps (heapdump, core dumps, profiler output, browser tab snapshots) — Volkswagen Spring actuator pattern
• Process command lines (/proc/PID/cmdline, /debug/pprof/cmdline, ps output) — Dgraph GHSA-95mq-xwj4-r47p
• DNS records (TXT records exposing internal service names, SPF records exposing service vendors, CNAME chains)
• Headers (Server, X-Powered-By, X-AspNet-Version, X-Framework, custom internal-name headers)
• Email headers and bounces (Received chains exposing internal mail server names, NDR responses leaking user existence)
• Webhooks / callback URLs (test webhook endpoints exposing internal service URLs in retry logs)
• CORS preflight responses (Access-Control-Allow-Origin reflecting attacker origin reveals trusted-origin allowlist)
• Sitemap, robots.txt (admin paths, dev environment URLs, staging hostnames)
• Public-by-design APIs accidentally returning private fields — over-fetching, GraphQL field-level (cross-references hunt-idor and hunt-xss)
• Enumeration endpoints — different responses for existing vs non-existing user/email/UUID enable username harvesting (MinIO LDAP GHSA-jv87-32hw-hh99 pattern)
• Cache headers leaking auth state (X-Cache: HIT / Vary mismatches reveal authenticated content cached publicly)

For each surface, send: curl -sI https://target/<path> (header inspection), curl -s https://target/<path> | head -100 (body inspection), curl -s -X POST -H "Content-Type: application/json" -d '{}' https://target/<endpoint> (error elicitation), and run nuclei -t exposures/ against the host for the canonical exposure templates.

Step-by-Step Hunting Methodology

1. Subdomain enumeration first. subfinder + amass + chaos + crt.sh → every subdomain. Each is a candidate for .git/, .env, /actuator/, /server-status. The exposed-config attack surface scales linearly with subdomain count; legacy / dev / staging subdomains are the highest-yield targets.

2. Run nuclei exposures/ template set on every subdomain. nuclei -t http/exposures/ covers .git/HEAD, .env, /server-status, /actuator/*, /swagger.json, /.well-known/, /phpinfo, hundreds more. Single command, ~30 seconds per host. The H1 2026 wp-config disclosures (reports 3328408, 3252302) and /server-status disclosure (2473173) are all canonical nuclei-template hits.

3. Spring Boot Actuator deep-probe. If host responds with Server: containing Tomcat/Jetty/Undertow OR X-Application-Context: header OR /actuator/health returns 200 — probe the full endpoint set with priority ordering: /actuator/heapdump (CRITICAL — full memory dump), /actuator/env (HIGH — env vars), /actuator/configprops, /actuator/beans, /actuator/threaddump, /actuator/mappings, /actuator/loggers, /actuator/gateway/routes (CVE-2025-41243). For /actuator/heapdump, download the binary, analyze with Eclipse Memory Analyzer (MAT) or strings | grep -E 'AKIA|AIza|sk_live|ghp_' for secret patterns.

4. .env and .git/ direct probe on every subdomain. curl -s https://target/.env and curl -s https://target/.git/HEAD. If 200 OK with content, run git-dumper https://target/.git/ /tmp/dumped to recover the entire repo. Then trufflehog filesystem /tmp/dumped --only-verified to extract live credentials.

5. wp-config.php and backup-file fuzzing. Use ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -u https://target/FUZZ -mc 200. Append common backup extensions: wp-config.php{,.bak,.old,~,.swp,.swo,.copy,.backup}. The H1 2026 wp-config reports came from this exact technique against forgotten subdomains.

6. Source-code repo secret scanning. For OSS targets and any program with GitHub presence in scope: trufflehog github --org=<org> --only-verified (uses 800+ detectors with active credential validation). Cross-check with gitleaks on cloned repos. Reference TruffleHog: https://github.com/trufflesecurity/trufflehog. Caveat: most bug bounty programs classify credential exposure as out-of-scope; check program policy first (see Cremit Apr 2026 analysis at https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure).

7. Cloud bucket discovery. From subdomain list, derive bucket-name candidates: <subdomain>, <subdomain>-prod, <subdomain>-staging, <subdomain>-backup, <subdomain>-logs, <subdomain>-data. Test each against https://<name>.s3.amazonaws.com, https://<name>.blob.core.windows.net, https://storage.googleapis.com/<name>. Use s3scanner or AWSBucketDump for automation. ESHYFT-class findings come from this exact enumeration on healthcare/financial targets.

8. Debug endpoint family. For Go services: /debug/pprof/cmdline (Dgraph GHSA-95mq-xwj4-r47p — exposes admin token in process args). For Spring: actuator family above. For Glances/Prometheus/Grafana monitoring: /api/4/serverslist (GHSA-r297-p3v4-wp8m), /metrics, /prometheus, /dashboards/api/. For Kubernetes: /healthz/secret, /api/v1/secrets against kubelet anonymous-auth misconfigs.

9. API over-fetching audit. For every authenticated API endpoint, request the data and inspect response. Look for fields that shouldn't be there: password_hash, password_salt, tokens[], api_keys[], internal_notes, admin_comments, kyc_documents, mfa_secrets, recovery_codes. The over-fetch pattern is mid four-figure on most programs.

10. User / email enumeration. Compare login response (timing, body, status) for known-existing vs non-existing username. Same for password reset, registration ("email already in use" vs "verification sent"). MinIO GHSA-jv87-32hw-hh99 (LDAP brute-force via enumeration + missing rate limit) is the canonical 2026 case. Document the timing delta or response delta.

11. Stack trace / debug page elicitation. Send malformed requests to every endpoint: ', null, [], {"a":}, large bodies, missing required fields, content-type mismatches. Watch for 500 responses with full stack traces, file paths, framework versions, DB type. These are mid three-figure direct unless they reveal something materially sensitive (DB connection string, internal IP, framework + version → CVE replay candidate).

12. Mobile app reverse engineering. Pull APK with apktool d <apk> or IPA with ipsw. Run strings <binary> | grep -iE '(api[_-]?key|secret|token|password|bearer|aws_access_key)'. Inspect assets/, res/raw/, META-INF/ for plaintext config. Mobile-app secret leaks are mid four-figure on iOS/Android program scope.

13. Validate before reporting. Demonstrable impact: count the records (PII), validate the credential is live (aws sts get-caller-identity for AWS keys; curl https://api.github.com/user -H "Authorization: token <ghp>" for GitHub tokens), show the exfil path. Don't dump the whole bucket — three records is enough proof. See Gate 0.

Payload & Detection Patterns

Sub-technique A — .env and config-file direct probe

# Direct .env probe
curl -s -o /dev/null -w "%{http_code}\n" https://target/.env
curl -s https://target/.env | head -50

# Common variants — try each
for path in .env .env.local .env.production .env.development \
           .env.bak .env.old .env~ .env.example .env.sample \
           env .environment app.env config.env; do
  curl -s -o /dev/null -w "%{http_code} %s\n" $path https://target/$path
done

# Laravel-specific (Unit42 Aug 2024 attack pattern)
curl -s https://target/.env | grep -E '^(APP_KEY|DB_PASSWORD|MAIL_PASSWORD|AWS_ACCESS_KEY|AWS_SECRET|MAILGUN)'

# Symfony / NextJS variants
curl -s https://target/.env.local
curl -s https://target/.next/server/.env

# WordPress wp-config (H1 2026 reports 3328408, 3252302)
for ext in '' .bak .old '~' .swp .swo .copy .backup; do
  curl -s -o /dev/null -w "%{http_code} %s\n" "wp-config.php$ext" "https://target/wp-config.php$ext"
done

Sub-technique B — .git/ directory exposure (Sysdig EmeraldWhale 2024 pattern)