Public info: threat model
Storage buckets, static landing pages and other static content
- can be enumerated, sometimes surprisingly so
- ranges from
.git
and deploy scripts to secrets in static JS - can contain secrets that are only usable in the application context (e.g. session encryption keys)
Landings and static content: example
A landing page deployed automatically may contain this:
![](https://tenendo.com/wp-content/uploads/2022/10/Pasted-image-20220926140338.png)
Buckets: examples
lots of “lists of shame”:
![](https://tenendo.com/wp-content/uploads/2022/10/Pasted-image-20220920172549.png)
Third-party services
A list of examples ordered by frequency of exploitation:
- File sharing solutions (the worst of them all)
- Jira/Confluence/other knowledge bases
- Backup solutions especially self-developed ones
Third-party services: what can happen
This:
![](https://tenendo.com/wp-content/uploads/2022/10/Pasted-image-20220920165425.png)