⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

HUNT-SOURCE-LEAK — Source Code & Build Artifact Leakage

Crown Jewel Targets

Source map exposing TypeScript source = see all API routes, auth logic, secrets. Swagger/OpenAPI JSON = complete API surface map.

Highest-value findings:

• .js.map source maps — reconstruct full TypeScript/ES6 source code → find hardcoded API keys, internal endpoints, auth logic bypasses
• swagger.json / openapi.json — complete REST API specification with all endpoints, parameters, auth schemes, and internal route names
• .env / .env.production — APP_KEY, DB_PASSWORD, API_KEY, SECRET_KEY in plaintext
• .git/ exposure — git clone the entire source history → all past hardcoded secrets
• asset-manifest.json / _next/static/ — all JS bundle paths → systematic source map discovery
• build-info / info.json — git commit hash, build timestamp, dependency versions → CVE targeting

Phase 1 — Quick Wins (Run First)

# These 10 requests take <30 seconds and often yield Critical findings
for PATH in \
  "/.env" \
  "/.env.production" \
  "/.env.local" \
  "/.git/HEAD" \
  "/swagger.json" \
  "/api/swagger.json" \
  "/v1/swagger.json" \
  "/openapi.json" \
  "/api/openapi.json" \
  "/api-docs"; do
  STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$PATH")
  if [ "$STATUS" = "200" ]; then
    echo "[+] HIT: https://$TARGET$PATH"
    head -5 /tmp/sl_test
    echo "---"
  fi
done

Phase 2 — Source Map Discovery

Always resolve the CURRENT build hash before testing, and again before re-verifying. Bundle filenames are content-hashed, so they rotate on every deploy. A .map URL recorded yesterday can 404 today while the map is still fully exposed under a new name. A 404 at the old URL is not remediation — it is a new build.

# ALWAYS derive the hash live, never reuse a recorded URL
HASH=$(curl -s "https://$TARGET/" | grep -oE 'main\.[a-f0-9]+\.js' | head -1)
curl -s -o /dev/null -w '%{http_code} %{size_download} %{content_type}\n' \
  "https://$TARGET/static/js/${HASH}.map"

Lesson from an authorized engagement. A large production map was found at main.<hashA>.js.map. On re-verification that URL returned a small HTML soft-404 and the finding was nearly closed as fixed. The bundle had rotated to main.<hashB>.js — and the map was still published at main.<hashB>.js.map, same size. Nothing had been remediated.

Tell the client this explicitly in the report: redeploying does not fix source map exposure. Only GENERATE_SOURCEMAP=false (or stripping .map at deploy) plus a CDN purge closes it. A team that redeploys and re-checks the old link will wrongly declare victory.

Same rule applies to any content-hashed artifact: chunk files, CSS maps, asset-manifest.json, and staging equivalents.

# Step 1: Get asset manifest to find all JS bundle paths
curl -s "https://$TARGET/asset-manifest.json" | python3 -m json.tool 2>/dev/null
curl -s "https://$TARGET/static/js/main.*.js" 2>/dev/null | head -3

# Next.js
BUILD_ID=$(curl -s https://$TARGET/ | grep -oP '"buildId":"\K[^"]+')
curl -s "https://$TARGET/_next/static/$BUILD_ID/_buildManifest.js" | head -5

# Step 2: For each JS bundle, check for source map reference at end of file
for JS_URL in $(curl -s https://$TARGET/ | grep -oP 'src="[^"]*\.js"' | sed 's/src="//;s/"//'); do
  LAST_LINE=$(curl -s "https://$TARGET$JS_URL" | tail -1)
  echo "$LAST_LINE" | grep -q "sourceMappingURL" && echo "[+] Source map: $JS_URL"
done

# Step 3: Download and reconstruct source from .map files

…