RoastMyOpsecBlog
Exposure classes we keep seeing on marketing sites: secrets, VCS crumbs, maps, and treasure-map robots.txt. Ten guides per page.
Page 7 of 7
Vulnerabilities · May 26, 2022
Cargo.toml vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /Cargo.toml (and Cargo.lock) donates crate names, features,…
Read guide →Vulnerabilities · Apr 13, 2022
backup.sql.gz vs dump.sql on a production origin is the same database souvenir in two costumes. /dump.sql is often schema and rows in text — the roast signatures SQL-shaped bodies on that well-known name. A .sql.gz is…
Read guide →Vulnerabilities · Apr 5, 2022
An AWS credentials file vs .env on a production origin is two containers for the same class of secret. /.env often holds AWS_ACCESS_KEY_ID-shaped values — the roast signatures that path. A copied credentials file from a…
Read guide →Vulnerabilities · Mar 10, 2022
App auth paths vs website login pages is a surface split. A marketing /login or CMS /wp-login.php is a document. App origins expose /api, /oauth, /auth, /graphql, and /v1 — discoverability plus 401/403 behavior.…
Read guide →Vulnerabilities · Jan 27, 2022
Admin login discoverability vs access control is a mismatch that shows up on marketing sites and SaaS origins alike. Finding /admin, /wp-admin, or /login is reconnaissance, not a breach. Guessable URLs deserve MFA, SSO,…
Read guide →Vulnerabilities · Jan 10, 2022
Access-Control-Expose-Headers vs CORS Allow-Origin is two Fetch CORS knobs. Access-Control-Allow-Origin decides which browser origins may read the response at all. Access-Control-Expose-Headers names extra response…
Read guide →