Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Source map exposure → API key leak → cloud takeover

Public *.js.map files reveal un-minified source and inline-committed API keys (cloud provider, third-party services). Use the keys directly.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: SPA built with a bundler that publishes source maps to the static origin in production. Developers committed at least one cloud credential into source.

§ Steps

  1. 01
    Exfil / pivot via the trusted keyExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Authenticate to the third-party / cloud APIInitial Access
    T1078— Valid Accounts
  3. 03
    Spider JS bundlesReconnaissance
    W-RECON-DIRBRUTE— Directory & File Bruteforce
  4. 04
    Grep for keys (AWS, Stripe, SendGrid…)Reconnaissance
    W-RECON-JS-SECRETS— Hardcoded Secrets in JS Bundles
  5. 05
    Reconstruct un-minified sourceReconnaissance
    W-RECON-SOURCEMAP— JavaScript Source Map Exposure
  6. 06
    Download *.js.map filesReconnaissance
    W-RECON-SOURCEMAP— JavaScript Source Map Exposure

§ References

§ Frequently asked

What is the "Source map exposure → API key leak → cloud takeover" attack path?
Public *.js.map files reveal un-minified source and inline-committed API keys (cloud provider, third-party services). Use the keys directly. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil / pivot via the trusted key (T1041) — a exfiltration primitive. Assumed environment: SPA built with a bundler that publishes source maps to the static origin in production.
What is the final impact of this kill-chain?
The final step lands on Download *.js.map files (W-RECON-SOURCEMAP), which falls under Reconnaissance. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers