RoastMyOpsecBlog
Exposure classes we keep seeing on marketing sites: secrets, VCS crumbs, maps, and treasure-map robots.txt. Ten guides per page.
Page 6 of 7
Vulnerabilities · Jul 8, 2023
.dockerignore vs Dockerfile on a production origin is two build-context files that must not be public objects. /Dockerfile is the image recipe. /.dockerignore is the list of paths you kept out of the context — often the…
Read guide →Vulnerabilities · Jun 30, 2023
Dockerfile vs package.json on production origins is two build manifests on a public object store. /package.json donates dependency names and versions — useful for OSV homework, not a pentest. A public /Dockerfile (or…
Read guide →Vulnerabilities · Jun 4, 2023
Directory listing vs 403 for backup and static folders is a map-versus-lock decision. Autoindex (an 'Index of /' HTML page) lists every file the web server will serve in that path — backups, old zips, leftover SQL…
Read guide →Vulnerabilities · May 27, 2023
desktop.ini vs Thumbs.db on production CDNs is two Windows leftovers next to index.html. desktop.ini is a folder-customization file (icon, InfoTip, localized name) that can list paths and sometimes point at a .ico you…
Read guide →Vulnerabilities · Oct 9, 2022
crossdomain.xml vs CORS for public browser APIs is two generations of cross-origin policy. CORS (Access-Control-Allow-Origin and friends) is what browsers enforce on fetch and XHR. /crossdomain.xml is an Adobe Flash…
Read guide →Vulnerabilities · Sep 30, 2022
CORS wildcard vs allowlist is a trust-boundary choice for browser-called APIs, not a performance tweak. Access-Control-Allow-Origin: * is acceptable only for responses that are meant to be read by any website and that…
Read guide →Vulnerabilities · Sep 22, 2022
CORS credentials vs wildcard origins is a combination the Fetch spec forbids. If Access-Control-Allow-Credentials is true, Access-Control-Allow-Origin must be an explicit origin, not *. Reflecting any Origin while…
Read guide →Vulnerabilities · Sep 13, 2022
CORP vs CORS for embedding and fetch isolation is a deny-by-default versus allow-by-name split. Cross-Origin-Resource-Policy (same-origin or same-site) tells browsers to refuse this response as a cross-origin no-cors…
Read guide →Vulnerabilities · Jul 24, 2022
composer.json vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /composer.json (and composer.lock) donates PHP packages…
Read guide →Vulnerabilities · Jun 29, 2022
CircleCI config vs GitHub workflows on a production origin is two CI description trees sitting where only the website should live. Workflow YAML can name jobs, third-party actions, environments, and sometimes plaintext…
Read guide →