Strix•信息泄露测试

Information Disclosure

Information leaks accelerate exploitation by revealing code, configuration, identifiers, and trust boundaries. Treat every response byte, artifact, and header as potential intelligence. Minimize, normalize, and scope disclosure across all channels.

Attack Surface

• Errors and exception pages: stack traces, file paths, SQL, framework versions
• Debug/dev tooling reachable in prod: debuggers, profilers, feature flags
• DVCS/build artifacts and temp/backup files: .git, .svn, .hg, .bak, .swp, archives
• Configuration and secrets: .env, phpinfo, appsettings.json, Docker/K8s manifests
• API schemas and introspection: OpenAPI/Swagger, GraphQL introspection, gRPC reflection
• Client bundles and source maps: webpack/Vite maps, embedded env, __NEXT_DATA__, static JSON
• Headers and response metadata: Server/X-Powered-By, tracing, ETag, Accept-Ranges, Server-Timing
• Storage/export surfaces: public buckets, signed URLs, export/download endpoints
• Observability/admin: /metrics, /actuator, /health, tracing UIs (Jaeger, Zipkin), Kibana, Admin UIs
• Directory listings and indexing: autoindex, sitemap/robots revealing hidden routes

High-Value Surfaces

Errors and Exceptions

• SQL/ORM errors: reveal table/column names, DBMS, query fragments
• Stack traces: absolute paths, class/method names, framework versions, developer emails
• Template engine probes: {{7*7}}, ${7*7} identify templating stack
• JSON/XML parsers: type mismatches leak internal model names

Debug and Env Modes

• Debug pages: Django DEBUG, Laravel Telescope, Rails error pages, Flask/Werkzeug debugger, ASP.NET customErrors Off
• Profiler endpoints: /debug/pprof, /actuator, /_profiler, custom /debug APIs
• Feature/config toggles exposed in JS or headers

DVCS and Backups

• DVCS: /.git/ (HEAD, config, index, objects), .svn/entries, .hg/store → reconstruct source and secrets
• Backups/temp: .bak/.old/~/.swp/.swo/.tmp/.orig, db dumps, zipped deployments
• Build artifacts: dist artifacts containing .map, env prints, internal URLs

Configs and Secrets

• Classic: web.config, appsettings.json, settings.py, config.php, phpinfo.php
• Containers/cloud: Dockerfile, docker-compose.yml, Kubernetes manifests, service account tokens
• Credentials and connection strings; internal hosts and ports; JWT secrets

API Schemas and Introspection

• OpenAPI/Swagger: /swagger, /api-docs, /openapi.json — enumerate hidden/privileged operations
• GraphQL: introspection enabled; field suggestions; error disclosure via invalid fields
• gRPC: server reflection exposing services/messages

Client Bundles and Maps

• Source maps (.map) reveal original sources, comments, and internal logic
• Client env leakage: NEXT_PUBLIC_/VITE_/REACT_APP_ variables; embedded secrets
• __NEXT_DATA__ and pre-fetched JSON can include internal IDs, flags, or PII

Headers and Response Metadata

• Fingerprinting: Server, X-Powered-By, X-AspNet-Version
• Tracing: X-Request-Id, traceparent, Server-Timing, debug headers
• Caching oracles: ETag/If-None-Match, Last-Modified/If-Modified-Since, Accept-Ranges/Range

Storage and Exports

• Public object storage: S3/GCS/Azure blobs with world-readable ACLs or guessable keys
• Signed URLs: long-lived, weakly scoped, re-usable across tenants
• Export/report endpoints returning foreign data sets or unfiltered fields

Observability and Admin

• Metrics: Prometheus /metrics exposing internal hostnames, process args
• Health/config: /actuator/health, /actuator/env, Spring Boot info endpoints
• Tracing UIs: Jaeger/Zipkin/Kibana/Grafana exposed without auth

Cross-Origin Signals

• Referrer leakage: missing/weak referrer policy leading to path/query/token leaks to third parties
• CORS: overly permissive Access-Control-Allow-Origin/Expose-Headers revealing data cross-origin; preflight error shapes

File Metadata

• EXIF, PDF/Office properties: authors, paths, software versions, timestamps, embedded objects

Cloud Storage

• S3/GCS/Azure: anonymous listing disabled but object reads allowed; metadata headers leak owner/project identifiers
• Pre-signed URLs: audience not bound; observe key scope and lifetime in URL params

Key Vulnerabilities

Differential Oracles

• Compare owner vs non-owner vs anonymous for the same resource
• Track: status, length, ETag, Last-Modified, Cache-Control
• HEAD vs GET: header-only differences can confirm existence
• Conditional requests: 304 vs 200 behaviors leak existence/state

CDN and Cache Keys

• Identity-agnostic caches: CDN/proxy keys missing Authorization/tenant headers
• Vary misconfiguration: user-agent/language vary without auth vary leaks content
• 206 partial content + stale caches leak object fragments

Cross-Channel Mirroring

• Inconsistent hardening between REST, GraphQL, WebSocket, and gRPC
• SSR vs CSR: server-rendered pages omit fields while JSON API includes them

Triage Rubric

• Critical: Credentials/keys; signed URL secrets; config dumps; unrestricted admin/observability panels
• High: Versions with reachable CVEs; cross-tenant data; caches serving cross-user content
• Medium: Internal paths/hosts enabling LFI/SSRF pivots; source maps revealing hidden endpoints
• Low: Generic headers, marketing versions, intended documentation without exploit path

Exploitation Chains

Credential Extraction

• DVCS/config dumps exposing secrets (DB, SMTP, JWT, cloud)
• Keys → cloud control plane access

Version to CVE

• Derive precise component versions from headers/errors/bundles
• Map to known CVEs and confirm reachability
• Execute minimal proof targeting disclosed component

Path Disclosure to LFI

• Paths from stack traces/templates reveal filesystem layout
• Use LFI/traversal to fetch config/keys

Schema to Auth Bypass

• Schema reveals hidden fields/endpoints
• Attempt requests with those fields; confirm missing authorization

Testing Methodology

• Build channel map - Web, API, GraphQL, WebSocket, gRPC, mobile, background jobs, exports, CDN
• Establish diff harness - Compare owner vs non-owner vs anonymous; normalize on status/body length/ETag/headers
• Trigger controlled failures - Malformed types, boundary values, missing params, alternate content-types
• Enumerate artifacts - DVCS folders, backups, config endpoints, source maps, client bundles, API docs
• Correlate to impact - Versions→CVE, paths→LFI/RCE, keys→cloud access, schemas→auth bypass

Validation

• Provide raw evidence (headers/body/artifact) and explain exact data revealed
• Determine intent: cross-check docs/UX; classify per triage rubric
• Attempt minimal, reversible exploitation or present a concrete step-by-step chain
• Show reproducibility and minimal request set
• Bound scope (user, tenant, environment) and data sensitivity classification

False Positives

• Intentional public docs or non-sensitive metadata with no exploit path
• Generic errors with no actionable details
• Redacted fields that do not change differential oracles
• Version banners with no exposed vulnerable surface and no chain
• Owner-visible-only details that do not cross identity/tenant boundaries

Impact

• Accelerated exploitation of RCE/LFI/SSRF via precise versions and paths
• Credential/secret exposure leading to persistent external compromise
• Cross-tenant data disclosure through exports, caches, or mis-scoped signed URLs
• Privacy/regulatory violations and business intelligence leakage

Pro Tips

• Start with artifacts (DVCS, backups, maps) before payloads; artifacts yield the fastest wins
• Normalize responses and diff by digest to reduce noise when comparing roles
• Hunt source maps and client data JSON; they often carry internal IDs and flags
• Probe caches/CDNs for identity-unaware keys; verify Vary includes Authorization/tenant
• Treat introspection and reflection as configuration findings across GraphQL/gRPC
• Mine observability endpoints last; they are noisy but high-yield in misconfigured setups
• Chain quickly to a concrete risk and stop—proof should be minimal and reversible

Summary

Information disclosure is an amplifier. Convert leaks into precise, minimal exploits or clear architectural risks.