Sensitive Data Exposure| Information Disclosure | ScriptJacker

Sensitive Data Exposure

Information Disclosure

referred

combines

private information

improperly disclosed

confidentiality

integrity

exploitable

vulnerabilities

enumeration

reconnaissance

closely related

flaws in the encryption

safeguard sensitive data

sensitive data exposure

cryptographic failures

1. Google Dorking

crafting

search queries

sensitive information

misconfigured

exposed directories

Manual Approach

inurl:/phpMyAdmin/index.php?server=1
inurl:node_modules/ua-parser-js
index of /wp-admin.jpg site:bd
phpMyAdmin SQL Dump ext:txt

Google Hacking Database (GHDB)

Automatic Approach

2. Github Dorking

GitHub repositories

configuration files

unauthorized access

Manual Approach

"api_hash" "api_id"
path:*.php db_connect
"testphp.vulnweb.com" password
"company.com" token

Automatic Approach

3. Find Sensitive Data Manually

1. Web Crawler Files

Web crawlers are automated programs that systematically browse the web to collect data from websites. Web crawler files can potentially help identify sensitive information and information disclosure in various ways.

Identifying hidden files and directories

//robots.txt file may contain
User-agent: *
Disallow: /private/
Disallow: /admin-panel67/
Disallow: /sensitive-data.txt

//sitemap.xml file may contain
<?xml version="1.0" encoding="UTF-8"?>
<url>
  <loc>http://www.ex.com/pvt-data.html</loc>
  <lastmod>2023-11-08</lastmod>
  <changefreq>weekly</changefreq>
  <priority>0.8</priority>
</url>
<url>
  <loc>http://www.ex.com/secret.htm</loc>
  <lastmod>2023-11-08</lastmod>
  <changefreq>monthly</changefreq>
  <priority>0.6</priority>
</url>
</urlset>

Testing for directory listing

User-agent: *
Disallow: /ftp/
Disallow: /css/
Disallow: /images/

Investigating API endpoints

User-agent: *
Disallow: /api/
Disallow: /api/v1/users/
Disallow: /api/v1/login/

Examining URL structures

User-agent: *
Disallow: /search?q=
Disallow: /*?param1=&pparam2=
Disallow: /*?category=

Using Web Archive

// old robots.txt find in web archive
User-agent: *
Disallow: /category/
Disallow: /admin-panel-269
Disallow: /search?q=

// new robots.txt present in website
User-agent: *
Disallow: /category/
Disallow: /search?q=

2. Directory Listing

Directory listing is a feature of web servers that allows users to view a list of files and directories on the server. This can be useful for finding files that are not linked to from any web pages, or for finding hidden files and directories. However, directory listing can also be a security risk, as it can allow attackers to see what files are on the server and potentially exploit vulnerabilities in the server software.

Using Google dorks

Google Dorks

inurl:example.com intitle:"index of"
inurl:example.com intitle:"index of /" "*key.pem"
inurl:example.com ext:log
inurl:example.com intitle:"index of" ext:sql|xls|xml|json|csv
inurl:example.com "MYSQL_ROOT_PASSWORD:" ext:env OR ext:yml -git
inurl:example.com intitle:"index of" "config.db"
inurl:example.com allintext:"API_SECRET*" ext:env | ext:yml
inurl:example.com intext:admin ext:sql inurl:admin
inurl:example.com allintext:username,password filetype:log

Using Web Crawler Files

User-agent: *
Disallow: /ssh/
Disallow: /assets/
Disallow: /user/list/

Through Web Browsers

When you visit a directory that does not exist on a web server, the server will typically return a 404 error page. This page will usually contain a message indicating that the directory does not exist. However, some web servers are configured to allow directory listing, even for directories that do not exist. When directory listing is enabled, the server will generate a list of the files and directories in the parent directory of the requested directory. This list will be displayed in a web page, which will be returned to the user.

Index of /

Name	       Last                Size
index.html	 2023-03-08 12:00:00 1024 bytes
about.html	 2023-03-08 12:00:00 512 bytes
contact.html 2023-03-08 12:00:00 256 bytes

Using httpx tool

cat live.txt | httpx -td -title

3. Developer Comments

Developer comments in source code or configuration files can sometimes inadvertently reveal sensitive information and contribute to information disclosure or data exposure. These comments, while intended to provide context and documentation, can be overlooked or not properly sanitized, leading to security risks. It can reveal information like API keys, path or file disclosure, system information/version or credentials, etc.

Manual Code Review

<!DOCTYPE html>
<html>
<head>
  <title>My Vulnerable Website
    <!-- Running on PHP 5.6.30 - Consider upgrading for security. -->
  </title>
</head>
<body>
  <!-- The password for the admin panel is 'admin@784'. -->
  <div id="content">
    <!-- Include the API key here for access: '9876543210zyxwvu' -->
    <!-- File path for sensitive data: /var/www/html/secrets/passwords.txt -->
    <!-- TODO: Implement user authentication -->
    <script src="/path/to/old-library.js">
    <!-- Some sensitive debug information -->
    <!-- Debug: Disable this on the production server -->
  </div>
</body>
</html>

Using Version Control System

4. Error Messages

Improper Error Handling can be a valuable source of information for attackers. They can reveal the inner workings of a system, including the technologies used, the software versions, and the configuration settings. It occurs when an application or website provides error messages that reveal more information than they should. This information can be used to identify vulnerabilities that can be exploited to gain access to the system or to steal sensitive data.

Here are some known places where error message can be be seen.

Error Pages

Form Fields:

Server Responses

Normal Pages

  console.log("Error: " + error.message.replace(/password|credit card number|social security number/gi, "*****"));

The browser's console

Here are some ways in which error messages can be used for information disclosure

  Error: An error occurred while processing your request.

Stack trace:
  at /home/user/public_html/index.php:123
  at /home/user/public_html/functions.php:456
  at /home/user/public_html/config.php:1011
  at /home/user/public_html/index.php:1

Stack Traces or Debugging Information

  Error: Could not find file /www/html/home/user/secret.txt

Path Disclosure

  Error: SQLSTATE[HY000]: General error: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE name = 'John'' at line 1

Database Errors

"The username johndoe does not exist."
"The password for the username johndoe is incorrect."
"The username johndoe is locked."
"The username johndoe has been disabled."

Credential Confirmation

Sensitive Data Validation

For example: If we request a password reset token so site should show that "If user is registered he will receive email" but it shows that "User is not registered".

//request
GET /api/users/1 HTTP/1.1
Host: example.com
id=32

//response
HTTP/1.1 200 OK
Content-Type: application/json
{
  "status": 200,
  "message": "User with test@gmail.com of id=32 has already been deleted one day ago."
}

Response Length

Guidelines for Crafting Effective Error Messages

Use encoded characters in parameter values For example, you could encode the characters "admin" as "%61%64%6D%69%6E" or double encoding or encode symbols. This may cause the server to return an error message revealing sensitive information.

Use long parameter values Some servers may have a limit on the length of parameter values. If you exceed this limit, the server may return an error message that contains the sensitive information.

Use invalid parameter values Some servers may not handle invalid parameter values correctly. If you provide an invalid parameter value, the server may return an error message that contains information.

Use multiple parameter values Some servers may allow you to specify multiple values for a single parameter. If you provide multiple values, the server may return an error message that contains a list of the values that were provided. This could reveal sensitive information, such as a list of usernames or passwords.

Use multiple parameters Some servers may allow you to specify multiple parameters. If you provide multiple parameters, the server may return error.

Use a combination of techniques You can combine multiple techniques to increase the likelihood of triggering an error that contains sensitive information. For example, you could use encoded characters in parameter values and also use long parameter values.

5. Insecure Configuration

Insecure configurations for HTTP methods can lead to a variety of attacks, including information disclosure, cross-site scripting (XSS), and remote code execution (RCE).

The following HTTP methods can give you reward if enabled:

TRACE

OPTIONS

PUT

DELETE

There many ways to find insecure configurations for HTTP methods. Here are few listed:

CURL

curl -v -X OPTIONS http://www.example.com

Web Browser

Web Proxy

//before
GET / HTTP/1.1
Host: www.example.com

//after
TRACE / HTTP/1.1
Host: www.example.com

NMAP

Important

6. Version Control System

Version control systems (VCS), such as Git, SVN, or Mercurial, are powerful tools for tracking changes in source code and collaborating on software projects. However, if sensitive information is committed to a repository, it poses a significant security risk. VCS can be used to identify sensitive data or information disclosure by tracking changes to files over time. A attacker can try to visit /.git or /git.

Some ways that attacker can use to identify VCS.

Google Dorks

inurl:.git
inurl:.svn
inurl:.hg
site:target.com inurl:.git
inurl:source control
inurl:version control
“.git” intitle:”Index of”
filetype:git -github.com inurl:”/.git”

Web Archive

Directory Traversal

https://target.com/.git/config
https://target.com/.git
https://target.com/.svn

Github Dorks

"target.com" .git
"target.com" .svn
"target.com" git
"target.com" source control
"target.com" version control

7. Server Response

Information disclosure through server responses can occur due to various misconfigurations or vulnerabilities. Here are some server responses may inadvertently leak sensitive information:

Error Message

//Request
GET /nonexistent-page HTTP/1.1

//Response
HTTP/1.1 404 Not Found
Server: Apache/2.4.18 (Ubuntu)
Content-Type: text/html

{ "status":404 "message":"Apache/2.4.18 (Ubuntu) Server at example.com Port 80" }

Directory Listing

//Request
GET /private/ HTTP/1.1

//Response
HTTP/1.1 200 OK
Server: Microsoft-IIS/10.0
Content-Type: text/html

<html>
<head>
<title>Index of /private</title>
</head>
<body>
  <h1>Index of /private</h1>
  <ul>
        <li>docs/</a></li>
        <li>data.csv</li>
        </ul>
  <hr>
    <address>Microsoft-IIS/10.0 Server at example.com Port 80</address>
</body>
</html>

Server Headers

//Request
GET / HTTP/1.1

//Response
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Content-Type: text/html; charset=UTF-8

Verbose HTTP Headers

//Request
GET / HTTP/1.1

//Response
HTTP/1.1 200 OK
Server: Apache/2.4.18 (Ubuntu)
X-Powered-By: PHP/7.2.4
Content-Type: text/html; charset=UTF-8

Exposed Database Errors

//Request
GET /user/123 HTTP/1.1

//Response
HTTP/1.1 500 Internal Server Error
Server: Apache/2.4.18 (Ubuntu)
Content-Type: text/html

<html>
<head>
<title>Internal Server Error</title>
</head>
<body>
    <h1>Internal Server Error</h1>
    <p>Database error: SQL syntax error near 'OR 1=1' at line 1</p>
</body>
</html>

Exposed Session Tokens

  Request: GET /dashboard HTTP/1.1
Response:
HTTP/1.1 200 OK
Server: Apache/2.4.18 (Ubuntu)
Content-Type: text/html

<html>
<head>
<title>User Dashboard</title>
</head>
<body>
<p>Welcome, User123!</p>
<input type="hidden" name="session_token" value="abcdef123456">
</body>
</html>

8. View Source Code

The frontend source code can provide verious information like: Credentials, Comments with Sensitive Information, Debugging Information, Exposed API Keys, Unprotected Endpoints, Information Leakage through Error Handling, hidden fields, etc.

4. Information Disclosure Automatic Approach

1. Directory Brute forcing

Directory busting is a technique used to discover hidden files and directories on a web server. It can be used to find sensitive information, such as configuration files, database credentials, version control system, error pages, directory listing, backup files, source code, log files and all other things that you have read upwards.

Directory busting can be a very effective way to find sensitive information on a web server. However, it is important to note that directory busting can also be a time-consuming process. The number of directories and files that you need to search can be very large, and it can take a long time to find anything sensitive.

Gobuster

gobuster dir -u http://target.com/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Dirbuster

dirbuster -u http://target.com/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Feroxbuster

feroxbuster -u http://example.com/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Burpsuite

Target -> Site map -> Add -> Directory enumeration -> Start scan

Wordlists

2. Javascript Recon

JavaScript recon is a technique used to extract sensitive information from JavaScript code. This can be done by using a variety of tools and techniques.

Extract JS Files

GetJS

Katana

getJS --complete --url https://target.com > javascript.txt
katana -u https://target.com -d 2 -jc | grep -i ".js$" | uniq > js.txt

Making it readable

beautifier

Extract Information

Secretfinder

Linkfinder

 cat js.txt | while read url; do python3 linkfinder.py -i $url -o cli >> secret.txt; done
 cat js.txt | while read url; do python3 SecretFinder.py -i $url -o cli >> secret.txt; done

Shell script

JSFScan.sh

 ./JSFScan.sh -l target.txt --all

Important

3. Fuzzing Target

Fuzzing is a technique used to find security vulnerabilities in websites by providing invalid, unexpected, or malformed data to the website and observing the results. Fuzzing can be used to find information disclosure vulnerabilities, which occur when sensitive information is unintentionally exposed to users or attackers.

FFUF

    ffuf -u http://example.com/FUZZ/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

wfuzz

    wfuzz -w wordlist/general/common.txt --hc 404 http://example.com/FUZZ

5. Web Archive - Wayback Machines

Web Archiving

historical records

track changes

Attacker can use web archive to see sensitive information which maybe removed from current website but present in old website like credentials, backup files, config files, etc.

Manual Approach

Automatic Approach

6. Mitigation Practices

Implementing Robust Mitigation Techniques for Sensitive Data Exposure

Data Classification and Encryption Classify data and encrypt it in transit and at rest to protect sensitive information. Use HTTPS instead of HTTP.

Access Controls Implement strict access controls to limit data access to authorized users and roles.

Secure Coding Practices Follow secure coding practices to prevent common vulnerabilities that could lead to data exposure or cryptographic weaknesses.

Key Management Implement strong key management practices for secure encryption and cryptographic operations.

Data Masking/Redaction Mask or redact sensitive data in non-production environments to reduce exposure during development and testing.

Regular Updates and Patching Keep software components, cryptographic libraries, and systems up-to-date with the latest security patches.

web application firewall A WAF can help to block attacks that attempt to exploit vulnerabilities in web applications.

Monitoring and Alerts Implement monitoring and alerting systems to detect and respond to suspicious cryptographic activities and data exposure.

7. Reference Reports

This is an report about a sensitive information through google dorking.

Report 1

This is an article about a security researcher who found sensitive information in a public GitHub repository.

Report 2

This is a report about information exposure through directory listing. It discusses the risks of exposing a directory listing.

Report 3

The report details an application error message that may disclose sensitive information.

Report 4

In this report stack trace error is shown with sensitive information.

Report 5

The verbose SQL error with sensitive information is shown on page.

Report 6

The vulnerability allowed an attacker to view private source code and configuration files.

Report 7

This is a report about a vulnerability in the wayback machine that allowed users' private notes to be disclosed.

Report 8

This is an article about a security vulnerability report. The report details a vulnerability that could allow an attacker to gain access to sensitive information.

Report 9

8. Solve Labs/Machines

Metasploitable 2

sensitive information

improving skills

mitigating

Lab 1

Portswigger's

teach

information disclosure

Lab 2

Back to Home