bchecks/File-level Backup Detection.bcheck at main · KaustubhRai/bchecks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
metadata:
    language: v2-beta
    name: "File-level Backup Detection"
    description: "Checks if backup copies of the current request's file are accessible by appending common backup extensions (e.g., login.php.bak). Complements the directory-level Backup Files Exposure check."
    author: "Kaustubh"

run for each:
    file_ext =
        ".bak",
        ".old",
        ".orig",
        ".backup",
        ".copy",
        ".tmp",
        "~",
        ".save",
        ".swp"

given request then
    # Build path by extracting everything after the host (strip query string) and appending the extension
    send request called filebak:
        method: "GET"
        replacing path: `{regex_replace({base.request.url}, "^.*?\/.*?\/.*?(\/[^?#]*)", "$1")}{file_ext}`

    if {filebak.response.status_code} is "200" then
        # Confirm with garbage path to eliminate soft-404 false positives
        send request called garbage:
            method: "GET"
            replacing path: `/{random_str(12)}`

        if {garbage} differs from {filebak} then
            report issue and continue:
                severity: medium
                confidence: firm
                detail: `File-level backup accessible at current path with extension {file_ext}. The response differs from a random path, suggesting the file genuinely exists.`
                remediation: "Remove backup copies of source files from web-accessible directories. Ensure build/deploy pipelines do not leave temporary files on the server."
        end if
    end if