nuclei-templates/exposures/backups/zip-backup-files.yaml

id: zip-backup-files

info:
  name: Compressed Backup File
  author: toufik-airane,dwisiswant0,ffffffff0x
  severity: medium
  tags: exposure,backup

requests:
  - method: GET
    path:
      - "{{BaseURL}}/{{FQDN}}.{{EXT}}"  # www.example.com
      - "{{BaseURL}}/{{RDN}}.{{EXT}}"   # example.com
      - "{{BaseURL}}/{{DN}}.{{EXT}}"    # example

    attack: pitchfork
    payloads:
      EXT:
        - "7z"
        - "bz2"
        - "gz"
        - "lz"
        - "rar"
        - "tar.gz"
        - "xz"
        - "zip"
        - "z"
        - "tar.z"
        - "db"
        - "sqlite"
        - "sqlitedb"
        - "sql.7z"
        - "sql.bz2"
        - "sql.gz"
        - "sql.lz"
        - "sql.rar"
        - "sql.tar.gz"
        - "sql.xz"
        - "sql.zip"
        - "sql.z"
        - "sql.tar.z"

    max-size: 500 # Size in bytes - Max Size to read from server response
    matchers-condition: and
    matchers:
      - type: binary
        binary:
          - "377ABCAF271C"  # 7z
          - "314159265359"  # bz2
          - "53514c69746520666f726d6174203300"  # SQLite format 3.
          - "1f8b"  # gz tar.gz
          - "526172211A0700"  # rar RAR archive version 1.50
          - "526172211A070100"  # rar RAR archive version 5.0
          - "FD377A585A0000"  # xz tar.xz
          - "1F9D"  # z tar.z
          - "1FA0"  # z tar.z
          - "4C5A4950"  # lz
          - "504B0304"  # zip
        condition: or
        part: body

      - type: regex
        regex:
          - "application/[-\\w.]+"
        part: header

      - type: status
        status:
          - 200