Summary

In this chapter, you've learned about the deficiency (and sometimes validity) of security by obscurity as a philosophy, how to unmask a site's hidden content with Burp and other tools, how to distinguish between different types of sensitive information, a rough guide to information that doesn't merit a bounty payout, and taking a data leak vulnerability from discovery to report formatting and submission. You should now feel prepared to incorporate at least basic hidden content discovery methods into your pentesting regimen.