skills.rest
marcboggs
marcboggsCOMMUNITY
Explore all skills by this author →
GitHub

hunt-source-leak

Detect exposed source maps, Swagger specs, .env files, and .git directories on web targets.

1|Updated Aug 21, 2026
Search Tags:#reconnaissance#swagger#pentest#bug bounty#secret scanning#source maps#git exposure
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-source-leak-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-source-leak
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/hunt-source-leak
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-source-leak-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires git-dumper, trufflehog, ds_store.

What problem does it solve? Web applications frequently leak source code, API specifications, and credentials through misconfigured build artifacts, and manually probing dozens of well-known paths is slow and error-prone. This Skill systematizes the discovery of source maps, Swagger/OpenAPI definitions, .env files, exposed .git repositories, and debug endpoints during reconnaissance. ## Core Features & Use Cases - Source Map Reconstruction: Discovers content-hashed .js.map files, extracts original TypeScript/ES6 source, and greps it for hardcoded API keys, secrets, and internal endpoints. - API Surface Discovery: Enumerates swagger.json/openapi.json paths and parses them to list every documented endpoint, including internal routes not visible in the UI. - Credential & History Exposure: Tests for .env and .git exposure, reconstructs repositories with git-dumper, and scans git history with trufflehog for past secrets. - Use Case: At the start of an authorized bug bounty engagement, run the quick-win checks against the target to find an exposed asset-manifest.json, follow it to a live source map, and extract a hardcoded API key that unlocks the rest of the attack surface. ## Quick Start Run the source leak hunt against https://target.example.com and report any exposed source maps, Swagger files, .env files, or .git directories you find.

Frequently Asked Questions about hunt-source-leak

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed source maps on a website?▼

Extract the current content-hashed bundle name from the page HTML, then request the same filename with a .map extension appended. Check the last line of each JS bundle for a sourceMappingURL comment, and always re-derive the hash live since bundle names rotate on every deploy.

How to extract source code from a .js.map file?▼

Download the map file and parse its JSON, which contains sources and sourcesContent arrays. Write each entry in sourcesContent to its corresponding path from sources to reconstruct the original TypeScript or ES6 files, then grep the output for API keys and secrets.

What tools detect exposed .git directories on web servers?▼

First request /.git/HEAD and check for a ref: response to confirm exposure. Then use git-dumper to reconstruct the full repository and run trufflehog against the git history to find secrets committed in the past.

Why does a source map URL return 404 after a redeploy?▼

Bundle filenames are content-hashed, so every deploy generates a new hash and the old map URL stops resolving. A 404 at the old URL does not mean remediation; re-derive the current hash from the page and test the new .map URL before closing the finding.

What severity is an exposed .env file in a bug bounty report?▼

An exposed .env file containing credentials like DATABASE_URL, API_KEY, or SECRET_KEY is rated Critical. Exposed .git with secrets in history is also Critical, while source maps with secrets are High and Swagger with internal routes is Medium-High.

Related Skills

Explore More Software Engineering Skills→
guaidao2guaidao2
81

httpx

Probe live HTTP and HTTPS hosts and collect response metadata.

Community
Intermediate
wgpsecwgpsec
1.7k

mobile-backend

Tests mobile app backend APIs for authentication flaws, IDOR, and business logic vulnerabilities.

Official
Intermediate
duriandurinoduriandurino

vuln

Match service versions to known CVEs and public exploits.

Community
Advanced
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced