Recon & Exposure
Subdomain takeover, leaked keys and the information disclosure that starts every chain.
A backup file left in the web root
Find the secret the application leaks without meaning to.
Comments in the source with a key in them
Find the secret the application leaks without meaning to.
The stack trace that names the database
Find the secret the application leaks without meaning to.
A CNAME pointing at a deleted bucket
Claim a dangling DNS record that points at an unclaimed host.
Secrets committed to an exposed .git
Find the secret the application leaks without meaning to.
The debug endpoint still answering in production
Find the secret the application leaks without meaning to.
The pages site that was never published
Claim a dangling DNS record that points at an unclaimed host.
User enumeration through timing
Find the secret the application leaks without meaning to.
An API version that forgot to retire
Find the secret the application leaks without meaning to.
An expired CDN configuration still referenced
Claim a dangling DNS record that points at an unclaimed host.
GraphQL introspection left switched on
Find the secret the application leaks without meaning to.
Metadata in an uploaded file's response
Find the secret the application leaks without meaning to.
The cancelled SaaS that left a dangling record
Claim a dangling DNS record that points at an unclaimed host.
Chaining a takeover into cookie theft
Claim a dangling DNS record that points at an unclaimed host.