Sensitive file probing (sfp)

Sensitive file probing

Requests target commonly sensitive files, configs, backups, or administrative resources.

Attack family · Sensitive file exposure and leak hunting Phase · Reconnaissance and loot discovery Risk · High

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.

Focus

Sensitive file paths, configs, backups, and Git metadata
Traversal-style file access attempts
Direct payload hints such as `/etc/passwd` reads and command-style file parameters

Logic

Strong hits target `.env`, SSH keys, OS secrets, CMS configs, and exposed admin artifacts.
Traversal and sensitive-file hints are deduplicated so the strongest rule wins.
Weak file/path parameters only matter when stronger probing context is present.

Attack Family

Sensitive file exposure and leak hunting

Phase · Reconnaissance and loot discovery Risk · High

Requests for environment files, backups, Git metadata, and hidden configs are how attackers look for accidental exposure that grants instant leverage without needing an exploit.

Damage Patterns

A single exposed config or backup can hand over credentials, secrets, infrastructure layout, or deployment history.
This family regularly turns misconfiguration into immediate data loss or privileged follow-on access.

Incident Lore

Some of the fastest compromises come from leaked `.env`, repository metadata, backup archives, and admin artifacts rather than sophisticated exploitation.
Operators often discover these incidents late because the requests looked like simple 404 hunting until one path finally existed.

How To Read It

This is an opportunistic recon and exposure probe signal. It explains why the request looked like a hunt for accidental leaks.

Defender Takeaway

Treat sensitive-file probing as treasure hunting. The attacker is looking for the one mistake that collapses the rest of the defense stack.

Catalog Definition

Flags attempts to access files and paths that are commonly sensitive or frequently exposed by mistake (configuration files, environment files, backups, admin panels, hidden resources). This annotator is especially useful for explaining opportunistic scanning behavior. In reports, show targeted resources grouped by category and the observed outcomes (404/403/200) without implying compromise.

Sensitive file probing

What This Annotator Watches

10 Most Recent Real Samples

Confirm Action