source-leak · diff
git:20260602.95e27a7 to git:20260709.a882698
20 added, 72 removed. Audit A to A.
---
name: source-leak
description: >
- Source code leak detection via GitHub, Gitee, and search engine
- dorking. Uses tech stack fingerprints to construct targeted search
- queries for leaked source code, configs, and credentials.
+ Search public code and metadata for credentials, identifiers, internal
+ routes, and business context that can feed later testing.
metadata:
- tags: "source-leak,github,gitee,credentials,config"
- category: "offensive-security"
+ tags: "source-leak,github,gitee,credentials"
---
- # Source Code Leak Search
-
- ## Methodology
-
- ```
- Step 1: Tech fingerprint → determine search keywords
- ├── Frontend: Vue/React specific code snippets
- ├── Backend: /actuator, /api/xxx patterns
- ├── Page title/copyright/error message characteristic strings
- └── Cookie names/Session ID format
-
- Step 2: GitHub/Gitee search
- ├── site:github.com "unique string" (Google dork)
- ├── github_search_code with unique code snippets
- ├── gitee_search_open_source_repositories with product name
- └── Priority: config files > source code > documentation
-
- Step 3: Secondary confirmation
- ├── Compare directory structure
- ├── Compare API routes
- ├── Compare frontend JS variable names/comments
- └── Save links after confirmation — do NOT download
- ```
-
- ## Search Query Construction
-
- ```
- # From tech fingerprint → search queries:
- 1. Unique error messages:
- "com.example.controller" "Internal Server Error"
-
- 2. Cookie/Header patterns:
- "JSESSIONID" "companyname"
-
- 3. Frontend code snippets:
- "apiBaseUrl" "https://target.com"
-
- 4. Page titles:
- "XX管理系统" in:readme
+ # Source Leak
- 5. File patterns:
- "application.yml" "spring.datasource.url"
- ".env" "DB_PASSWORD"
+ ## Goal
- 6. Framework config paths:
- path:pom.xml "groupId" "artifact"
- path:composer.json "name"
- ```
+ 从公开代码、提交记录、Issue、PR 和缓存中找能回注目标系统的标识符、凭据、内部路径和业务语义。
- ## High-Value Targets
+ ## Tools / Inputs
- ```
- □ Config files: application.yml, .env, settings.py, config.js
- □ Database config: JDBC URL, DB credentials, connection strings
- □ API keys: cloud service keys, third-party API keys
- □ Internal docs: README with architecture, deployment guide
- □ Test code: test data with real credentials
- □ CI/CD config: .gitlab-ci.yml, Jenkinsfile, GitHub Actions
- □ Docker config: Dockerfile, docker-compose.yml, environment vars
- ```
+ - GitHub/Gitee/search engine/cache、domain、company name、emails、repo metadata
+ - 参考：`references/js-analysis-source-leak.md`
- ## Tools
+ ## Constraints
- ```
- github_search_code: unique code snippet from target's JS
- github_search_repositories: product/company name
- gitee_search_open_source_repositories: product name
+ 1. 不下载或扩散敏感仓库，只记录最小证据。
+ 2. 凭据必须验证有效性后才升级。
+ 3. 发现邮箱/工号/手机号要回注 API/JWT/登录链路。
+ 4. 不能验证的泄露作为 PENDING/INFO。
+ 5. 请求凭据时必须附登录入口。
- Google dork:
- site:github.com "target-unique-string"
- site:gitee.com "target-unique-identifier"
+ ## Chain Questions
- GitDorker / truffleHog: for credential leaks
- Focus: .env, config files, docker-compose.yml, credentials.json
- ```
+ - 泄露信息能否登录、签名、解密、访问云资源或定位内部 API？
+ - 是否能和当前端点参数匹配？
+ - commit/issue 是否暴露测试账号、环境域名、接口文档？
+ - 新标识符应该回到哪个攻击面？