Unmasking Hidden Content – How to Pull the Curtains Back

Exploring obfuscated, neglected, or otherwise exposed data is a critical exercise, both as part of a site's opening reconnaissance and as a dedicated end in itself.

We'll cover a couple of different ways, some passive and some more active, that will help you discover sensitive information that will win you a bounty payout.

Preliminary Code Analysis

It's a simple step, but walking through the page's source and being able to get a sense of the code style and quality, framework, any extra connected services, and just a general feel for the code base powering the app is essential, and can lead to surprising finds.

...