What is Information Disclosure

Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users. Depending on the context, websites may leak all kinds of information to a potential attacker, including: Data about other users, such as usernames or financial information Sensitive commercial or business data

![[Screenshot from 2022-12-02 13-22-14.png]]

Type of Data that can be leaked:

• Data about other users (usernames or financial data)
• Sensitive commercial or business data
• Technical details about the website or infrastructure

Example of information disclosure:

• Revealing names of hidden directories
• Providing access to source code files via temporary backups
• Explicitly mentioning database table or column names in error messages
• Exposing sensitive info such as credit card details
• Hard-coding API keys, IPs, creds, etc in source code

These are often less severe but can become severe depending on the data. Even "less severe" information disclosure such as technical details can be used to further enumerate the web server or system and identify more flaws for exploitation. In other words, this can be chained together for more compromise.