[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73GAMAZEM14QN17GFD9MPQ3":3,"skill-same:01M73GAMAZEM14QN17GFD9MPQ3":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M73GAMAZEM14QN17GFD9MPQ3","testing-for-sensitive-data-exposure",null,"Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-for-sensitive-data-exposure\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-for-sensitive-data-exposure\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: testing-for-sensitive-data-exposure\ndescription: Identifying sensitive data exposure vulnerabilities including API key\n  leakage, PII in responses, insecure storage, and unprotected data transmission during\n  security assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- data-exposure\n- pii\n- owasp\n- web-security\n- api-keys\n- secrets\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\nnote: \"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.\"\n---\n\n# Testing for Sensitive Data Exposure\n\n## When to Use\n\n- During authorized penetration tests when assessing data protection controls\n- When evaluating applications for GDPR, PCI DSS, HIPAA, or other data protection compliance\n- For identifying leaked API keys, credentials, tokens, and secrets in application responses\n- When testing whether sensitive data is properly encrypted in transit and at rest\n- During security assessments of APIs that handle PII, financial data, or health records\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement with data handling scope\n- **Burp Suite Professional**: For intercepting and analyzing responses for sensitive data\n- **trufflehog**: Secret scanning tool (`pip install trufflehog`)\n- **gitleaks**: Git repository secret scanner (`go install github.com\u002Fgitleaks\u002Fgitleaks\u002Fv8@latest`)\n- **curl\u002Fhttpie**: For manual endpoint testing\n- **Browser DevTools**: For examining local storage, session storage, and cached data\n- **testssl.sh**: TLS configuration testing tool\n\n## Workflow\n\n### Step 1: Scan for Secrets in Client-Side Code\n\nSearch JavaScript files, HTML source, and other client-side resources for exposed secrets.\n\n```bash\n# Download and search JavaScript files for secrets\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | \\\n  grep -oP 'src=\"[^\"]*\\.js[^\"]*\"' | \\\n  grep -oP '\"[^\"]*\"' | tr -d '\"' | while read js; do\n    echo \"=== Scanning: $js ===\"\n    # Handle relative URLs\n    if [[ \"$js\" == \u002F* ]]; then\n      curl -s \"https:\u002F\u002Ftarget.example.com$js\"\n    else\n      curl -s \"$js\"\n    fi | grep -inE \\\n      \"(api[_-]?key|apikey|api[_-]?secret|aws[_-]?access|aws[_-]?secret|private[_-]?key|password|secret|token|auth|credential|AKIA[0-9A-Z]{16})\" \\\n      | head -20\ndone\n\n# Search for common secret patterns\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fstatic\u002Fapp.js\" | grep -nP \\\n  \"(AIza[0-9A-Za-z-_]{35}|AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9]{48}|ghp_[a-zA-Z0-9]{36}|xox[bpsa]-[0-9a-zA-Z-]{10,})\"\n\n# Check source maps for exposed source code\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fstatic\u002Fapp.js.map\" | head -c 500\n# Source maps may contain original source code with embedded secrets\n\n# Search HTML source for exposed data\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -inE \\\n  \"(api_key|secret|password|token|private_key|database_url|smtp_password)\" | head -20\n\n# Check for exposed .env or configuration files\nfor file in .env .env.local .env.production config.json settings.json \\\n  .aws\u002Fcredentials .docker\u002Fconfig.json; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002F$file\")\n  if [ \"$status\" == \"200\" ]; then\n    echo \"FOUND: $file ($status)\"\n  fi\ndone\n```\n\n### Step 2: Analyze API Responses for Data Over-Exposure\n\nCheck if API endpoints return more data than necessary.\n\n```bash\n# Fetch user profile and examine response fields\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Fme\" | jq .\n\n# Look for sensitive fields that should not be exposed:\n# - password, password_hash, password_salt\n# - ssn, social_security_number, national_id\n# - credit_card_number, card_cvv, card_expiry\n# - api_key, secret_key, access_token, refresh_token\n# - internal_id, database_id\n# - ip_address, session_id\n# - date_of_birth, drivers_license\n\n# Check list endpoints for excessive data\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq '.[0] | keys'\n\n# Compare public vs authenticated responses\necho \"=== Public ===\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F1\" | jq 'keys'\necho \"=== Authenticated ===\"\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F1\" | jq 'keys'\n\n# Check error responses for information leakage\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"invalid\": \"data\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n# Look for: stack traces, database queries, internal paths, version info\n\n# Test for PII in search\u002Fautocomplete responses\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fsearch?q=john\" | jq .\n# May return full user records instead of just names\n```\n\n### Step 3: Test Data Transmission Security\n\nVerify that sensitive data is encrypted during transmission.\n\n```bash\n# Check TLS configuration\n# Using testssl.sh\n.\u002Ftestssl.sh \"https:\u002F\u002Ftarget.example.com\"\n\n# Quick TLS checks with curl\ncurl -s -v \"https:\u002F\u002Ftarget.example.com\u002F\" 2>&1 | grep -E \"(SSL|TLS|cipher|subject)\"\n\n# Check for HTTP (non-HTTPS) endpoints\ncurl -s -I \"http:\u002F\u002Ftarget.example.com\u002F\" | head -5\n# Should redirect to HTTPS\n\n# Check for mixed content (HTTP resources on HTTPS pages)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -oP \"http:\u002F\u002F[^\\\"'> ]+\" | head -20\n\n# Check if sensitive forms submit over HTTPS\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Flogin\" | grep -oP 'action=\"[^\"]*\"'\n# Form action should use HTTPS\n\n# Check for sensitive data in URL parameters (query string)\n# URLs are logged in browser history, server logs, proxy logs, Referer headers\n# Look for: \u002Flogin?username=admin&password=secret\n# \u002Fapi\u002Fdata?ssn=123-45-6789\n# \u002Fsearch?credit_card=4111111111111111\n\n# Check WebSocket encryption\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -oP \"(ws|wss):\u002F\u002F[^\\\"'> ]+\"\n# ws:\u002F\u002F is unencrypted; should only use wss:\u002F\u002F\n```\n\n### Step 4: Examine Browser Storage for Sensitive Data\n\nCheck local storage, session storage, cookies, and cached responses.\n\n```bash\n# Check what cookies are set and their security attributes\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002Flogin\" | grep -i \"set-cookie\"\n\n# In browser DevTools (Application tab):\n# 1. Local Storage: Check for stored tokens, PII, credentials\n# 2. Session Storage: Check for temporary sensitive data\n# 3. IndexedDB: Check for cached application data\n# 4. Cache Storage: Check for cached API responses containing PII\n# 5. Cookies: Check for sensitive data in cookie values\n\n# Common insecure storage patterns:\n# localStorage.setItem('access_token', 'eyJ...');  \u002F\u002F XSS can steal\n# localStorage.setItem('user', JSON.stringify({email: '...', ssn: '...'}));\n# sessionStorage.setItem('credit_card', '4111...');\n\n# Check for autocomplete on sensitive forms\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Flogin\" | \\\n  grep -oP '\u003Cinput[^>]*(password|credit|ssn|card)[^>]*>' | \\\n  grep -v 'autocomplete=\"off\"'\n# Password and credit card fields should have autocomplete=\"off\"\n\n# Check Cache-Control headers on sensitive pages\nfor page in \u002Faccount\u002Fprofile \u002Fapi\u002Fusers\u002Fme \u002Ftransactions \u002Fbilling; do\n  echo -n \"$page: \"\n  curl -s -I \"https:\u002F\u002Ftarget.example.com$page\" \\\n    -H \"Authorization: Bearer $TOKEN\" | \\\n    grep -i \"cache-control\" | tr -d '\\r'\n  echo\ndone\n# Sensitive pages should have: Cache-Control: no-store\n```\n\n### Step 5: Scan Git Repositories and Source Code for Secrets\n\nSearch for accidentally committed secrets in version control.\n\n```bash\n# Check for exposed .git directory\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F.git\u002Fconfig\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F.git\u002FHEAD\"\n\n# If .git is exposed, use git-dumper to download\n# pip install git-dumper\ngit-dumper https:\u002F\u002Ftarget.example.com\u002F.git \u002Ftmp\u002Ftarget-repo\n\n# Scan downloaded repository with trufflehog\ntrufflehog filesystem \u002Ftmp\u002Ftarget-repo\n\n# Scan with gitleaks\ngitleaks detect --source \u002Ftmp\u002Ftarget-repo -v\n\n# If GitHub\u002FGitLab repository is available (authorized scope)\ntrufflehog github --org target-organization --token $GITHUB_TOKEN\ngitleaks detect --source https:\u002F\u002Fgithub.com\u002Forg\u002Frepo -v\n\n# Common secrets found in repositories:\n# - AWS access keys (AKIA...)\n# - Database connection strings\n# - API keys (Google, Stripe, Twilio, SendGrid)\n# - Private SSH keys\n# - JWT signing secrets\n# - OAuth client secrets\n# - SMTP credentials\n\n# Search for secrets in Docker images\n# docker save target-image:latest | tar x -C \u002Ftmp\u002Fdocker-layers\n# Search each layer for credentials\n```\n\n### Step 6: Test Data Masking and Redaction\n\nVerify that sensitive data is properly masked in the application.\n\n```bash\n# Check if credit card numbers are fully displayed\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fpayment-methods\" | jq .\n# Should show: **** **** **** 4242, not full number\n\n# Check if SSN\u002Fnational ID is masked\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Fme\" | jq '.ssn'\n# Should show: ***-**-6789, not full SSN\n\n# Check API responses for password hashes\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq '.[].password \u002F\u002F empty'\n# Should return nothing; password hashes should never be in API responses\n\n# Check export\u002Fdownload features for unmasked data\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Fexport?format=csv\" | head -5\n# CSV exports often contain unmasked PII\n\n# Check logging endpoints for sensitive data\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fadmin\u002Flogs\" | \\\n  grep -iE \"(password|token|secret|credit_card|ssn)\" | head -10\n# Logs should not contain sensitive data in plaintext\n\n# Test for sensitive data in error messages\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"duplicate@test.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fregister\"\n# Should not reveal: \"User with email duplicate@test.com already exists\"\n# Should show: \"Registration failed\" (generic)\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Sensitive Data Exposure** | Unintended disclosure of PII, credentials, financial data, or health records |\n| **Data Over-Exposure** | API returning more data fields than the client needs |\n| **Secret Leakage** | API keys, tokens, or credentials exposed in client-side code or logs |\n| **Data at Rest** | Sensitive data stored in databases, files, or backups without encryption |\n| **Data in Transit** | Sensitive data transmitted over network without TLS encryption |\n| **Data Masking** | Replacing sensitive data with redacted values (e.g., showing last 4 digits of credit card) |\n| **PII** | Personally Identifiable Information - data that can identify an individual |\n| **Information Leakage** | Excessive error messages, stack traces, or debug information in responses |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Response analysis and regex-based sensitive data scanning |\n| **trufflehog** | Secret detection across git repos, filesystems, and cloud storage |\n| **gitleaks** | Git repository scanning for hardcoded secrets |\n| **testssl.sh** | TLS\u002FSSL configuration assessment |\n| **git-dumper** | Downloading exposed .git directories from web servers |\n| **SecretFinder** | JavaScript file analysis for exposed API keys and tokens |\n| **Retire.js** | Detecting JavaScript libraries with known vulnerabilities |\n\n## Common Scenarios\n\n### Scenario 1: API Key in JavaScript Bundle\nThe application's JavaScript bundle contains a hardcoded Google Maps API key and a Stripe publishable key. The Stripe key has overly broad permissions, allowing the attacker to create charges.\n\n### Scenario 2: User API Returns Password Hashes\nThe `\u002Fapi\u002Fusers` endpoint returns complete user objects including bcrypt password hashes. Attackers can extract hashes and attempt offline cracking.\n\n### Scenario 3: PII in Cached API Responses\nThe user profile API endpoint returns full SSN and credit card numbers without masking. The endpoint does not set `Cache-Control: no-store`, so responses are cached in the browser and proxy caches.\n\n### Scenario 4: Git Repository with Database Credentials\nThe `.git` directory is accessible on the production server. Using git-dumper, the attacker downloads the repository history, finding database credentials committed in an early commit that were later \"removed\" but remain in git history.\n\n## Output Format\n\n```\n## Sensitive Data Exposure Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A02:2021 - Cryptographic Failures\n\n### Findings Summary\n| Finding | Severity | Data Type |\n|---------|----------|-----------|\n| API keys in JavaScript source | High | Credentials |\n| Password hashes in API response | Critical | Authentication |\n| Unmasked SSN in user profile | Critical | PII |\n| Credit card number in export | High | Financial |\n| .git directory exposed | Critical | Source code + secrets |\n| Missing TLS on API endpoint | High | All data in transit |\n| Sensitive data in error messages | Medium | Technical info |\n\n### Critical: Exposed Secrets\n| Secret Type | Location | Risk |\n|-------------|----------|------|\n| AWS Access Key (AKIA...) | \u002Fstatic\u002Fapp.js line 342 | AWS resource access |\n| Stripe Secret Key (sk_live_...) | .env (via .git exposure) | Payment processing |\n| Database URL with credentials | .git history commit abc123 | Database access |\n| JWT Signing Secret | config.json (via .git) | Token forgery |\n\n### Data Over-Exposure in APIs\n| Endpoint | Unnecessary Fields Returned |\n|----------|-----------------------------|\n| GET \u002Fapi\u002Fusers | password_hash, internal_id, created_ip |\n| GET \u002Fapi\u002Fusers\u002F{id} | ssn, credit_card_full, date_of_birth |\n| GET \u002Fapi\u002Forders | customer_phone, customer_address |\n\n### Recommendation\n1. Remove all hardcoded secrets from client-side code; use backend proxies\n2. Rotate all exposed credentials immediately\n3. Remove .git directory from production web root\n4. Implement response field filtering; return only required fields\n5. Mask sensitive data (SSN, credit card) in all API responses\n6. Add Cache-Control: no-store to all sensitive endpoints\n7. Enable TLS 1.2+ on all endpoints; redirect HTTP to HTTPS\n8. Implement secret scanning in CI\u002FCD pipeline (trufflehog\u002Fgitleaks)\n```\n","# Testing for Sensitive Data Exposure\n\n## When to Use\n\n- During authorized penetration tests when assessing data protection controls\n- When evaluating applications for GDPR, PCI DSS, HIPAA, or other data protection compliance\n- For identifying leaked API keys, credentials, tokens, and secrets in application responses\n- When testing whether sensitive data is properly encrypted in transit and at rest\n- During security assessments of APIs that handle PII, financial data, or health records\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement with data handling scope\n- **Burp Suite Professional**: For intercepting and analyzing responses for sensitive data\n- **trufflehog**: Secret scanning tool (`pip install trufflehog`)\n- **gitleaks**: Git repository secret scanner (`go install github.com\u002Fgitleaks\u002Fgitleaks\u002Fv8@latest`)\n- **curl\u002Fhttpie**: For manual endpoint testing\n- **Browser DevTools**: For examining local storage, session storage, and cached data\n- **testssl.sh**: TLS configuration testing tool\n\n## Workflow\n\n### Step 1: Scan for Secrets in Client-Side Code\n\nSearch JavaScript files, HTML source, and other client-side resources for exposed secrets.\n\n```bash\n# Download and search JavaScript files for secrets\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | \\\n  grep -oP 'src=\"[^\"]*\\.js[^\"]*\"' | \\\n  grep -oP '\"[^\"]*\"' | tr -d '\"' | while read js; do\n    echo \"=== Scanning: $js ===\"\n    # Handle relative URLs\n    if [[ \"$js\" == \u002F* ]]; then\n      curl -s \"https:\u002F\u002Ftarget.example.com$js\"\n    else\n      curl -s \"$js\"\n    fi | grep -inE \\\n      \"(api[_-]?key|apikey|api[_-]?secret|aws[_-]?access|aws[_-]?secret|private[_-]?key|password|secret|token|auth|credential|AKIA[0-9A-Z]{16})\" \\\n      | head -20\ndone\n\n# Search for common secret patterns\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fstatic\u002Fapp.js\" | grep -nP \\\n  \"(AIza[0-9A-Za-z-_]{35}|AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9]{48}|ghp_[a-zA-Z0-9]{36}|xox[bpsa]-[0-9a-zA-Z-]{10,})\"\n\n# Check source maps for exposed source code\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fstatic\u002Fapp.js.map\" | head -c 500\n# Source maps may contain original source code with embedded secrets\n\n# Search HTML source for exposed data\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -inE \\\n  \"(api_key|secret|password|token|private_key|database_url|smtp_password)\" | head -20\n\n# Check for exposed .env or configuration files\nfor file in .env .env.local .env.production config.json settings.json \\\n  .aws\u002Fcredentials .docker\u002Fconfig.json; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002F$file\")\n  if [ \"$status\" == \"200\" ]; then\n    echo \"FOUND: $file ($status)\"\n  fi\ndone\n```\n\n### Step 2: Analyze API Responses for Data Over-Exposure\n\nCheck if API endpoints return more data than necessary.\n\n```bash\n# Fetch user profile and examine response fields\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Fme\" | jq .\n\n# Look for sensitive fields that should not be exposed:\n# - password, password_hash, password_salt\n# - ssn, social_security_number, national_id\n# - credit_card_number, card_cvv, card_expiry\n# - api_key, secret_key, access_token, refresh_token\n# - internal_id, database_id\n# - ip_address, session_id\n# - date_of_birth, drivers_license\n\n# Check list endpoints for excessive data\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq '.[0] | keys'\n\n# Compare public vs authenticated responses\necho \"=== Public ===\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F1\" | jq 'keys'\necho \"=== Authenticated ===\"\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F1\" | jq 'keys'\n\n# Check error responses for information leakage\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"invalid\": \"data\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n# Look for: stack traces, database queries, internal paths, version info\n\n# Test for PII in search\u002Fautocomplete responses\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fsearch?q=john\" | jq .\n# May return full user records instead of just names\n```\n\n### Step 3: Test Data Transmission Security\n\nVerify that sensitive data is encrypted during transmission.\n\n```bash\n# Check TLS configuration\n# Using testssl.sh\n.\u002Ftestssl.sh \"https:\u002F\u002Ftarget.example.com\"\n\n# Quick TLS checks with curl\ncurl -s -v \"https:\u002F\u002Ftarget.example.com\u002F\" 2>&1 | grep -E \"(SSL|TLS|cipher|subject)\"\n\n# Check for HTTP (non-HTTPS) endpoints\ncurl -s -I \"http:\u002F\u002Ftarget.example.com\u002F\" | head -5\n# Should redirect to HTTPS\n\n# Check for mixed content (HTTP resources on HTTPS pages)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -oP \"http:\u002F\u002F[^\\\"'> ]+\" | head -20\n\n# Check if sensitive forms submit over HTTPS\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Flogin\" | grep -oP 'action=\"[^\"]*\"'\n# Form action should use HTTPS\n\n# Check for sensitive data in URL parameters (query string)\n# URLs are logged in browser history, server logs, proxy logs, Referer headers\n# Look for: \u002Flogin?username=admin&password=secret\n# \u002Fapi\u002Fdata?ssn=123-45-6789\n# \u002Fsearch?credit_card=4111111111111111\n\n# Check WebSocket encryption\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -oP \"(ws|wss):\u002F\u002F[^\\\"'> ]+\"\n# ws:\u002F\u002F is unencrypted; should only use wss:\u002F\u002F\n```\n\n### Step 4: Examine Browser Storage for Sensitive Data\n\nCheck local storage, session storage, cookies, and cached responses.\n\n```bash\n# Check what cookies are set and their security attributes\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002Flogin\" | grep -i \"set-cookie\"\n\n# In browser DevTools (Application tab):\n# 1. Local Storage: Check for stored tokens, PII, credentials\n# 2. Session Storage: Check for temporary sensitive data\n# 3. IndexedDB: Check for cached application data\n# 4. Cache Storage: Check for cached API responses containing PII\n# 5. Cookies: Check for sensitive data in cookie values\n\n# Common insecure storage patterns:\n# localStorage.setItem('access_token', 'eyJ...');  \u002F\u002F XSS can steal\n# localStorage.setItem('user', JSON.stringify({email: '...', ssn: '...'}));\n# sessionStorage.setItem('credit_card', '4111...');\n\n# Check for autocomplete on sensitive forms\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Flogin\" | \\\n  grep -oP '\u003Cinput[^>]*(password|credit|ssn|card)[^>]*>' | \\\n  grep -v 'autocomplete=\"off\"'\n# Password and credit card fields should have autocomplete=\"off\"\n\n# Check Cache-Control headers on sensitive pages\nfor page in \u002Faccount\u002Fprofile \u002Fapi\u002Fusers\u002Fme \u002Ftransactions \u002Fbilling; do\n  echo -n \"$page: \"\n  curl -s -I \"https:\u002F\u002Ftarget.example.com$page\" \\\n    -H \"Authorization: Bearer $TOKEN\" | \\\n    grep -i \"cache-control\" | tr -d '\\r'\n  echo\ndone\n# Sensitive pages should have: Cache-Control: no-store\n```\n\n### Step 5: Scan Git Repositories and Source Code for Secrets\n\nSearch for accidentally committed secrets in version control.\n\n```bash\n# Check for exposed .git directory\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F.git\u002Fconfig\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F.git\u002FHEAD\"\n\n# If .git is exposed, use git-dumper to download\n# pip install git-dumper\ngit-dumper https:\u002F\u002Ftarget.example.com\u002F.git \u002Ftmp\u002Ftarget-repo\n\n# Scan downloaded repository with trufflehog\ntrufflehog filesystem \u002Ftmp\u002Ftarget-repo\n\n# Scan with gitleaks\ngitleaks detect --source \u002Ftmp\u002Ftarget-repo -v\n\n# If GitHub\u002FGitLab repository is available (authorized scope)\ntrufflehog github --org target-organization --token $GITHUB_TOKEN\ngitleaks detect --source https:\u002F\u002Fgithub.com\u002Forg\u002Frepo -v\n\n# Common secrets found in repositories:\n# - AWS access keys (AKIA...)\n# - Database connection strings\n# - API keys (Google, Stripe, Twilio, SendGrid)\n# - Private SSH keys\n# - JWT signing secrets\n# - OAuth client secrets\n# - SMTP credentials\n\n# Search for secrets in Docker images\n# docker save target-image:latest | tar x -C \u002Ftmp\u002Fdocker-layers\n# Search each layer for credentials\n```\n\n### Step 6: Test Data Masking and Redaction\n\nVerify that sensitive data is properly masked in the application.\n\n```bash\n# Check if credit card numbers are fully displayed\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fpayment-methods\" | jq .\n# Should show: **** **** **** 4242, not full number\n\n# Check if SSN\u002Fnational ID is masked\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Fme\" | jq '.ssn'\n# Should show: ***-**-6789, not full SSN\n\n# Check API responses for password hashes\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq '.[].password \u002F\u002F empty'\n# Should return nothing; password hashes should never be in API responses\n\n# Check export\u002Fdownload features for unmasked data\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002Fexport?format=csv\" | head -5\n# CSV exports often contain unmasked PII\n\n# Check logging endpoints for sensitive data\ncurl -s -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fadmin\u002Flogs\" | \\\n  grep -iE \"(password|token|secret|credit_card|ssn)\" | head -10\n# Logs should not contain sensitive data in plaintext\n\n# Test for sensitive data in error messages\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"duplicate@test.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fregister\"\n# Should not reveal: \"User with email duplicate@test.com already exists\"\n# Should show: \"Registration failed\" (generic)\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Sensitive Data Exposure** | Unintended disclosure of PII, credentials, financial data, or health records |\n| **Data Over-Exposure** | API returning more data fields than the client needs |\n| **Secret Leakage** | API keys, tokens, or credentials exposed in client-side code or logs |\n| **Data at Rest** | Sensitive data stored in databases, files, or backups without encryption |\n| **Data in Transit** | Sensitive data transmitted over network without TLS encryption |\n| **Data Masking** | Replacing sensitive data with redacted values (e.g., showing last 4 digits of credit card) |\n| **PII** | Personally Identifiable Information - data that can identify an individual |\n| **Information Leakage** | Excessive error messages, stack traces, or debug information in responses |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Response analysis and regex-based sensitive data scanning |\n| **trufflehog** | Secret detection across git repos, filesystems, and cloud storage |\n| **gitleaks** | Git repository scanning for hardcoded secrets |\n| **testssl.sh** | TLS\u002FSSL configuration assessment |\n| **git-dumper** | Downloading exposed .git directories from web servers |\n| **SecretFinder** | JavaScript file analysis for exposed API keys and tokens |\n| **Retire.js** | Detecting JavaScript libraries with known vulnerabilities |\n\n## Common Scenarios\n\n### Scenario 1: API Key in JavaScript Bundle\nThe application's JavaScript bundle contains a hardcoded Google Maps API key and a Stripe publishable key. The Stripe key has overly broad permissions, allowing the attacker to create charges.\n\n### Scenario 2: User API Returns Password Hashes\nThe `\u002Fapi\u002Fusers` endpoint returns complete user objects including bcrypt password hashes. Attackers can extract hashes and attempt offline cracking.\n\n### Scenario 3: PII in Cached API Responses\nThe user profile API endpoint returns full SSN and credit card numbers without masking. The endpoint does not set `Cache-Control: no-store`, so responses are cached in the browser and proxy caches.\n\n### Scenario 4: Git Repository with Database Credentials\nThe `.git` directory is accessible on the production server. Using git-dumper, the attacker downloads the repository history, finding database credentials committed in an early commit that were later \"removed\" but remain in git history.\n\n## Output Format\n\n```\n## Sensitive Data Exposure Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A02:2021 - Cryptographic Failures\n\n### Findings Summary\n| Finding | Severity | Data Type |\n|---------|----------|-----------|\n| API keys in JavaScript source | High | Credentials |\n| Password hashes in API response | Critical | Authentication |\n| Unmasked SSN in user profile | Critical | PII |\n| Credit card number in export | High | Financial |\n| .git directory exposed | Critical | Source code + secrets |\n| Missing TLS on API endpoint | High | All data in transit |\n| Sensitive data in error messages | Medium | Technical info |\n\n### Critical: Exposed Secrets\n| Secret Type | Location | Risk |\n|-------------|----------|------|\n| AWS Access Key (AKIA...) | \u002Fstatic\u002Fapp.js line 342 | AWS resource access |\n| Stripe Secret Key (sk_live_...) | .env (via .git exposure) | Payment processing |\n| Database URL with credentials | .git history commit abc123 | Database access |\n| JWT Signing Secret | config.json (via .git) | Token forgery |\n\n### Data Over-Exposure in APIs\n| Endpoint | Unnecessary Fields Returned |\n|----------|-----------------------------|\n| GET \u002Fapi\u002Fusers | password_hash, internal_id, created_ip |\n| GET \u002Fapi\u002Fusers\u002F{id} | ssn, credit_card_full, date_of_birth |\n| GET \u002Fapi\u002Forders | customer_phone, customer_address |\n\n### Recommendation\n1. Remove all hardcoded secrets from client-side code; use backend proxies\n2. Rotate all exposed credentials immediately\n3. Remove .git directory from production web root\n4. Implement response field filtering; return only required fields\n5. Mask sensitive data (SSN, credit card) in all API responses\n6. Add Cache-Control: no-store to all sensitive endpoints\n7. Enable TLS 1.2+ on all endpoints; redirect HTTP to HTTPS\n8. Implement secret scanning in CI\u002FCD pipeline (trufflehog\u002Fgitleaks)\n```\n",{"name":5,"note":25,"tags":26,"author":34,"domain":35,"source":36,"license":15,"version":37,"nist_csf":38,"subdomain":43,"description":7,"nist_ai_rmf":44,"mitre_attack":48,"source_commit":53,"atlas_techniques":54},"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.",[27,28,29,30,31,32,33],"penetration-testing","data-exposure","pii","owasp","web-security","api-keys","secrets","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0",[39,40,41,42],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[45,46,47],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[49,50,51,52],"T1190","T1059.007","T1505.003","T1083","04450304b12645cb2b974ab96d28c0664758a88d",[55,56,57],"AML.T0070","AML.T0066","AML.T0082","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Ftesting-for-sensitive-data-exposure",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-13 13:15:29",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill testing-for-sensitive-data-exposure",{"tool":74,"command":75},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill testing-for-sensitive-data-exposure",{"tool":77,"command":78},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill testing-for-sensitive-data-exposure","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-for-sensitive-data-exposure\u002FSKILL.md",true,[82,86,92],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",1740,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-for-sensitive-data-exposure\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fagent.py","SCRIPT","脚本",9726,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-for-sensitive-data-exposure\u002Fscripts\u002Fagent.py",[99,107,114,122,130,138],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":103,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":126,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":134,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":139,"name":140,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]