Looking for confidential information in Drupal sites

[Father]

Pentesting a Drupal-based web application? Try to unload information for all installed modules. This information can point you to various files containing confidential information.

Get information about installed modules:

curl https://example.com/config/sync/core.extension.yml
curl https://example.com/core/core.services.yml

Load content from the files obtained in the previous step, for example:

curl https://example.com/config/sync/swiftmailer.transport.yml