nuclei-templates/http/exposures/backups/zip-backup-files.yaml

103 lines
2.2 KiB
YAML

id: zip-backup-files
info:
name: Compressed Backup File - Detect
author: toufik-airane,dwisiswant0,ffffffff0x,pwnhxl
severity: medium
description: Multiple compressed backup files were detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-200
tags: exposure,backup
http:
- method: GET
path:
- "{{BaseURL}}/{{FILENAME}}.{{EXT}}"
attack: clusterbomb
payloads:
FILENAME:
- "{{FQDN}}" # www.example.com
- "{{RDN}}" # example.com
- "{{DN}}" # example
- "{{SD}}" # www
- "{{date_time('%Y')}}" # 2023
- "ROOT" # tomcat
- "wwwroot"
- "htdocs"
- "www"
- "html"
- "web"
- "webapps"
- "public"
- "public_html"
- "uploads"
- "website"
- "api"
- "test"
- "app"
- "backup"
- "bin"
- "bak"
- "old"
- "Release"
EXT:
- "7z"
- "bz2"
- "gz"
- "lz"
- "rar"
- "tar.gz"
- "tar.bz2"
- "xz"
- "zip"
- "z"
- "tar.z"
- "db"
- "sqlite"
- "sqlitedb"
- "sql.7z"
- "sql.bz2"
- "sql.gz"
- "sql.lz"
- "sql.rar"
- "sql.tar.gz"
- "sql.xz"
- "sql.zip"
- "sql.z"
- "sql.tar.z"
- "war"
max-size: 500 # Size in bytes - Max Size to read from server response
matchers-condition: and
matchers:
- type: binary
binary:
- "377ABCAF271C" # 7z
- "314159265359" # bz2
- "53514c69746520666f726d6174203300" # SQLite format 3.
- "1f8b" # gz tar.gz
- "526172211A0700" # rar RAR archive version 1.50
- "526172211A070100" # rar RAR archive version 5.0
- "FD377A585A0000" # xz tar.xz
- "1F9D" # z tar.z
- "1FA0" # z tar.z
- "4C5A4950" # lz
- "504B0304" # zip
condition: or
part: body
- type: regex
regex:
- "application/[-\\w.]+"
part: header
- type: status
status:
- 200
# Enhanced by md on 2023/02/08