information disclosure
Leaking tokens, debug endpoints, source maps, exposed .git, header leaks.
Quick answer
What is information disclosure?
Leaking tokens, debug endpoints, source maps, exposed .git, header leaks.
Articles
4
Beginner
3
Intermediate
1
Advanced
0
Beginner level
3API keys exposed in public HTML — $2,000 without a single bypass
A productivity platform shipped a third-party CMS token in window.CONFIG. Anyone with DevTools could download paid templates. How to hunt this pattern in any SPA app.
Information Disclosure — the 12 highest-paying patterns
API keys in HTML, debug endpoints, verbose errors, JS bundles with secrets, exposed .git, header leaks. How to find it and why it's fixed fast and paid.
IP leak via a chat GIF — Client-Side Request Forgery + Information Disclosure
A social network didn't validate the URL of a GIF sent in chat. Sending a GIF revealed the victim's IP, operating system, phone model and device ID.
Intermediate level
1Practice information disclosure with real labs
Apply the techniques in safe environments based on real bug bounty reports.
hunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Stop reading about bugs and start hunting them
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime