feat(web2-recon): add source disclosure & extraction section

[letztek]

What

Adds a new ## SOURCE DISCLOSURE & EXTRACTION section to skills/web2-recon/SKILL.md, placed between the ## JS ANALYSIS and ## DIRECTORY FUZZING sections.

The section covers, with exact copy-paste commands:

• A one-shot triage sweep of the highest-signal disclosure paths across all live hosts (+ nuclei exposure,config,git,backup tags).
• Exposed VCS dumping — .git via git-dumper and GitTools (gitdumper.sh/extractor.sh), .svn via wc.db SQLite (1.7+) and entries/text-base (≤1.6), .hg and .bzr via dvcs-ripper, including the commit-history mining that turns a 200 into a real finding.
• .DS_Store recursive directory mapping via ds_store_exp plus a manual strings parse.
• Backup / temp / swap fuzzing with ffuf extension-mutation patterns, full-site archive guessing, Vim .swp recovery, and the SecLists BackupFiles.fuzz.txt list.
• PHP source reads via php://filter/convert.base64-encode (chained off an LFI sink) and .phps.
• Env/config leaks — .env, web.config, WEB-INF/web.xml, application.properties, appsettings.json, etc., as a table mapping each file to the secret it leaks and the escalation it unlocks.
• What to do with recovered source — a grep playbook to convert a dump into verified secrets, injectable sinks (SQLi/RCE/LFI/SSTI), bypassable auth logic, and new internal attack surface.

Why

The existing web2-recon pipeline does subdomain/URL/JS/secret recon but has no dedicated source-disclosure-and-extraction workflow. Source recovery is the single biggest force-multiplier in recon (black-box → white-box), and the pipeline lacked the dump-and-mine commands hunters reach for.

Everything is framed for bug bounty: every technique answers "can I prove impact RIGHT NOW", and the section is anchored by an explicit severity ladder (200 = Info → full source = Low → + verified secret / confirmed sink = High/Critical) so hunters report at the top of what they can prove and don't pad their N/A ratio with bare-disclosure submissions. Cross-references existing sections by title (SECRET SCANNING IN JS BUNDLES, Error Disclosure / Debug Endpoints, padding-oracle, SSRF/file-include classes), per house style.

The section uses standard CLI tooling only (git-dumper, GitTools, dvcs-ripper, ds_store_exp, ffuf, sqlite3, trufflehog, Python) — no new dependency. Techniques were verified against current (June 2026) write-ups for git-dumper, ds_store_exp, ffuf backup fuzzing, and php://filter source disclosure. No dollar figures or CVEs were fabricated.

Merge order

Self-contained enrichment of one file (skills/web2-recon/SKILL.md). Does not touch web2-vuln-classes or any numbered class, so no merge-order coupling.