#!/usr/bin/env bash
# Vector 16: Backup & Config File Exposure
# Desc: Find exposed backup files, config dumps, source code
# Detect: Any web server
# Severity: HIGH
# Tools: curl

vector_backup() {
  local target="$1"
  local report="$2"
  local findings=0
  local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
  
  print_info "Scanning for exposed backup/config files..."
  
  local files=(
    ".env"
    ".env.bak"
    ".env.backup"
    ".env.local"
    ".env.production"
    "config.php"
    "config.php.bak"
    "config.bak"
    "config.old"
    "db_backup.sql"
    "backup.sql"
    "dump.sql"
    "database.sql"
    "wp-config.php"
    "wp-config.php.bak"
    "config.php~"
    "composer.json"
    "package.json"
    "npm-shrinkwrap.json"
    ".htaccess"
    ".htpasswd"
    "phpinfo.php"
    "info.php"
    "test.php"
    "admin.php"
    "credentials.txt"
    "passwords.txt"
    "secrets.yml"
    "credentials.json"
    "aws.json"
    "azure.json"
    "gcp.json"
    "id_rsa"
    "id_rsa.pub"
    ".gitignore"
    "dump.rdb"
    "mongodump.gz"
    "error.log"
    "debug.log"
    "install.log"
    "access.log"
    "Dockerfile"
    "docker-compose.yml"
    "kubeconfig"
    ".kube/config"
  )
  
  for file in "${files[@]}"; do
    local code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null)
    
    if [[ "$code" =~ ^[23] ]]; then
      local size=$(curl -s --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null | wc -c | tr -d ' ')
      
      if [ "$size" -gt 10 ]; then
        local preview=$(curl -s --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null | head -c 200)
        
        print_find "Exposed: /$file" "($size bytes) HTTP $code"
        
        local sev="HIGH"
        if echo "$file" | grep -qi "\.env\|password\|secret\|credential\|key\|dump\|backup"; then
          sev="CRITICAL"
        fi
        
        echo "SEVERITY: $sev
VECTOR: Exposed File - $file
DETAIL: Sensitive/config file exposed at ${base}/$file
EVIDENCE: HTTP $code, $size bytes, preview: $preview
EXPLOIT: Download: curl -O ${base}/$file" > "$REPORTS_DIR/.finding_$(date +%s)_exposed-${file//\//_}.txt"
        findings=$((findings + 1))
      fi
    fi
  done
  
  return $findings
}