We discussed the objective of testing for sensitive information in this chapter. In terms of privacy testing, the GDPR is the primary baseline we will comply with. Privacy testing is focused on how PII is handled, and it's important to identify any risks of system-related sensitive information, such as passwords, API keys, or private IPs, being leaked. We looked at some patterns that help in searching for PII as well as sensitive system-related information.
We then looked at three case studies. The first case study was about searching for weak encryption using The Silver Searcher. The second case was about identifying potential API key leakage in the source code by using DumpsterDiver. The final case was about examining website privacy, looking specifically at the use of PrivacyScore to scan the target website.
We have practiced various kinds of white-box source code...
