Academy·ESC to go back View Recon & Info Disclosure labs

Recon & Info Disclosure

Discovering exposed sensitive information

Quick answer

What is Recon & Info Disclosure?

The reconnaissance phase is fundamental in bug bounty. Finding hidden endpoints, exposed config files, leaked credentials and misconfigured services can lead to high-impact findings.

Severity

Variable

Frequency

Very common

Payloads

Steps

Severity

Variable

Frequency

Very common

Payloads

Recon is the foundation of every successful bug bounty. It includes: subdomain enumeration, directory fuzzing, Google/GitHub dorking, JavaScript analysis and discovery of exposed services. Direct information disclosure (API keys, .env, .git) also falls into this category.

Credential exposureAccess to admin panelsDiscovery of internal APIsSource code leakageAccess to databases

Where to look

Config files

.env, .git, web.config, wp-config.php — hunt with dirbusting and Google dorks.

Debug endpoints

/swagger, /graphql, /debug, /phpinfo, /server-status, /actuator — endpoints that expose internal information.

Frontend JavaScript

JS bundles contain API endpoints, hardcoded tokens and internal config.

GitHub repositories

Search the company/domain name on GitHub. Secrets in commits, .env in public repos.

Verbose error responses

Stack traces, SQL errors, file paths — information that helps you understand the architecture.

Methodology

Enumerate subdomains

subfinder -d target.com | httpx — discover every active subdomain of the target.

Directory fuzzing

ffuf -u https://target.com/FUZZ -w common.txt — find hidden files and endpoints.

Google dorking

site:target.com ext:env | ext:log | ext:sql — look for indexed config files.

GitHub dorking

org:target filename:.env | password | api_key — look for secrets in repositories.

Analyze JavaScript

Download the JS bundles and look for: API endpoints, tokens, internal config, comments.

Shodan / Censys

hostname:target.com — discover exposed services: MongoDB, Redis, Elasticsearch, Jenkins.

Real-world case

API key in window.CONFIG → full CMS access → paid templates for free

$2,000

Inspect JavaScript

In the page source, find window.CONFIG with a Contentful CMS token.

Query the Contentful API

With the token, query the Contentful API to list every available content type.

Enumerate templates

Filter by 'template' and discover paid templates with their assets (downloadable files).

Download for free

Access the assets directly via the Contentful API — bypassing the paywall.

Lesson: Third-party service tokens (Contentful, Algolia, Firebase) should never reach the frontend. Always check window.CONFIG, __NEXT_DATA__ and similar.

Payloads

Google — config files

site:target.com ext:xml | ext:env | ext:yml | ext:log | ext:cfg

Google — exposed git

site:target.com inurl:.git intitle:"index of"

Google — SQL dumps

site:target.com filetype:sql "INSERT INTO" | "password"

Google — admin panels

site:target.com inurl:admin | inurl:"/wp-admin"

Subdomain enum

subfinder -d target.com -o subs.txt && httpx -l subs.txt -o alive.txt

Advanced payloads(account required)

GitHub — secrets

org:target-org filename:.env | filename:credentials | filename:.npmrc

GitHub — AWS keys

org:target-org AWS_SECRET_ACCESS_KEY | PRIVATE_KEY | api_key

Shodan — exposed services

hostname:target.com port:27017 (MongoDB) | port:6379 (Redis) | port:9200 (Elasticsearch)

trufflehog

trufflehog git https://github.com/target-org/repo.git

ffuf dirbusting

ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200,301,302

Wayback URLs

echo target.com | waybackurls | grep -E '\.env|\.git|admin|api|config|backup'

Protobuf decode

echo -n 'PARAM_VALUE' | base64 -d | protoc --decode_raw

Exclusive content

Create your free account to access advanced payloads, scripts and bypass techniques

Create free account

Tools

subfinder

Passive subdomain enumeration using multiple sources.

subfinder -d target.com -o subdomains.txt

httpx

Mass HTTP probing with technology detection.

httpx -l subdomains.txt -title -status-code -tech-detect

ffuf

Ultra-fast web fuzzer for directories, files and parameters.

ffuf -u https://target.com/FUZZ -w wordlist.txt

nuclei

Vulnerability scanner based on YAML templates.

nuclei -u https://target.com -t cves/

gitleaks

Detects secrets (API keys, passwords) in git repositories.

gitleaks detect -r /path/to/repo

Tips

Always check the JavaScript

Frontend JS bundles hold API endpoints, tokens and config. Use browser DevTools → Sources.

Exposed .git is gold

With git-dumper you can reconstruct the backend's full source code.

Automate with nuclei

nuclei -u target.com -t cves/ -t exposures/ -t technologies/ — mass template scanning.

Wayback Machine

web.archive.org has old versions with endpoints that may still be live on the backend.

Favicon hash on Shodan

Compute the favicon's mmh3 hash and search it on Shodan to find the origin IP behind the CDN.

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

Practice Recon & Info Disclosure with real labs

Apply these techniques in safe environments based on real bug bounty reports.

View Recon & Info Disclosure labs Create free account