92 lines
2.2 KiB
Bash
Executable File
92 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 16: Backup & Config File Exposure
|
|
# Desc: Find exposed backup files, config dumps, source code
|
|
# Detect: Any web server
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_backup() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
|
|
|
|
print_info "Scanning for exposed backup/config files..."
|
|
|
|
local files=(
|
|
".env"
|
|
".env.bak"
|
|
".env.backup"
|
|
".env.local"
|
|
".env.production"
|
|
"config.php"
|
|
"config.php.bak"
|
|
"config.bak"
|
|
"config.old"
|
|
"db_backup.sql"
|
|
"backup.sql"
|
|
"dump.sql"
|
|
"database.sql"
|
|
"wp-config.php"
|
|
"wp-config.php.bak"
|
|
"config.php~"
|
|
"composer.json"
|
|
"package.json"
|
|
"npm-shrinkwrap.json"
|
|
".htaccess"
|
|
".htpasswd"
|
|
"phpinfo.php"
|
|
"info.php"
|
|
"test.php"
|
|
"admin.php"
|
|
"credentials.txt"
|
|
"passwords.txt"
|
|
"secrets.yml"
|
|
"credentials.json"
|
|
"aws.json"
|
|
"azure.json"
|
|
"gcp.json"
|
|
"id_rsa"
|
|
"id_rsa.pub"
|
|
".gitignore"
|
|
"dump.rdb"
|
|
"mongodump.gz"
|
|
"error.log"
|
|
"debug.log"
|
|
"install.log"
|
|
"access.log"
|
|
"Dockerfile"
|
|
"docker-compose.yml"
|
|
"kubeconfig"
|
|
".kube/config"
|
|
)
|
|
|
|
for file in "${files[@]}"; do
|
|
local code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null)
|
|
|
|
if [[ "$code" =~ ^[23] ]]; then
|
|
local size=$(curl -s --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null | wc -c | tr -d ' ')
|
|
|
|
if [ "$size" -gt 10 ]; then
|
|
local preview=$(curl -s --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null | head -c 200)
|
|
|
|
print_find "Exposed: /$file" "($size bytes) HTTP $code"
|
|
|
|
local sev="HIGH"
|
|
if echo "$file" | grep -qi "\.env\|password\|secret\|credential\|key\|dump\|backup"; then
|
|
sev="CRITICAL"
|
|
fi
|
|
|
|
echo "SEVERITY: $sev
|
|
VECTOR: Exposed File - $file
|
|
DETAIL: Sensitive/config file exposed at ${base}/$file
|
|
EVIDENCE: HTTP $code, $size bytes, preview: $preview
|
|
EXPLOIT: Download: curl -O ${base}/$file" > "$REPORTS_DIR/.finding_$(date +%s)_exposed-${file//\//_}.txt"
|
|
findings=$((findings + 1))
|
|
fi
|
|
fi
|
|
done
|
|
|
|
return $findings
|
|
}
|