├── README.md
└── backup-file-finder.yaml


/README.md:
--------------------------------------------------------------------------------
 1 | # Bakup Files Finder Nuclei Template
 2 | 
 3 | This YAML file is a nuclei template used for discovering the hidden backup files in the webservers.
 4 | 
 5 | ## Usage
 6 | 
 7 | 
 8 | 
 9 | ```bash
10 |   nuclei -u https://yourtarget.com -t vabro-backup-file-finder.yaml
11 | ```
12 | or
13 | ```bash
14 | nuclei -l yourtargetlist.txt -t vabro-backup-file-finder.yaml
15 |     
16 | 


--------------------------------------------------------------------------------
/backup-file-finder.yaml:
--------------------------------------------------------------------------------
  1 | id: backup-files
  2 | info:
  3 |   name: Backup Files Finder (information disclosure)
  4 |   author: Vabro
  5 |   severity: High
  6 |   description: |
  7 |     This template checks for common backup file extensions that may have been left exposed on a target.
  8 | 
  9 | requests:
 10 |   - name: backup-files
 11 |     path:
 12 |       - "/backup"
 13 |       - "/backups"
 14 |       - "/root"
 15 |       - "/www"
 16 |       - "/public_html"
 17 |       - "/ht_docs"
 18 |       - "/files"
 19 |       - "/images"
 20 |       - "/assets"
 21 |       - "/media"
 22 |       - "/documents"
 23 |       - "/resources"
 24 |       - "/wp-content/uploads"
 25 |     method: GET
 26 |     matchers-condition: or
 27 |     matchers:
 28 |       - type: word
 29 |         words:
 30 |           - ".bak"
 31 |           - ".old"
 32 |           - ".zip"
 33 |           - ".tar"
 34 |           - ".tar.gz"
 35 |           - ".tar.bz2"
 36 |           - ".tar.xz"
 37 |           - ".7z"
 38 |           - ".rar"
 39 |           - ".gz"
 40 |           - ".bz2"
 41 |           - ".xz"
 42 |           - ".sql"
 43 |           - ".db"
 44 |           - ".bak"
 45 |           - ".swp"
 46 |           - ".swp"
 47 |           - ".save"
 48 |           - ".save"
 49 |           - ".sav"
 50 |           - ".sav"
 51 |           - ".copy"
 52 |           - ".copy"
 53 |           - ".backup"
 54 |           - ".backup"
 55 |           - ".orig"
 56 |           - ".orig"
 57 |           - ".old"
 58 |           - ".old"
 59 |           - ".tmp"
 60 |           - ".tmp"
 61 |           - ".temp"
 62 |           - ".temp"
 63 |           - ".test"
 64 |           - ".test"
 65 |           - ".demo"
 66 |           - ".demo"
 67 |           - ".dev"
 68 |           - ".dev"
 69 |           - ".sample"
 70 |           - ".sample"
 71 |           - ".example"
 72 |           - ".example"
 73 |           - ".backup"
 74 |           - ".backup"
 75 |           - ".config"
 76 |           - ".config"
 77 |           - ".conf"
 78 |           - ".conf"
 79 |           - ".log"
 80 |           - ".log"
 81 |           - ".txt"
 82 |           - ".txt"
 83 |           - ".doc"
 84 |           - ".doc"
 85 |           - ".docx"
 86 |           - ".xls"
 87 |           - ".xlsx"
 88 |           - ".ppt"
 89 |           - ".pptx"
 90 |           - ".pdf"
 91 |           - ".csv"
 92 |           - ".bak"
 93 |           - ".bak"
 94 |           - ".swp"
 95 |           - ".swp"
 96 |           - ".save"
 97 |           - ".save"
 98 |           - ".sav"
 99 |           - ".sav"
100 |           - ".copy"
101 |           - ".copy"
102 |           - ".backup"
103 |           - ".backup"
104 |           - ".orig"
105 |           - ".orig"
106 |           - ".old"
107 |           - ".old"
108 |           - ".tmp"
109 |           - ".tmp"
110 |           - ".temp"
111 |           - ".temp"
112 |           - ".test"
113 |           - ".test"
114 |           - ".demo"
115 |           - ".demo"
116 |           - ".dev"
117 |           - ".dev"
118 |           - ".sample"
119 |           - ".sample"
120 |           - ".example"
121 |           - ".example"
122 |           - ".backup"
123 |           - ".backup"
124 |           - ".config"
125 |           - ".config"
126 |           - ".conf"
127 |           - ".conf"
128 |           - ".log"
129 |           - ".log"
130 |           - ".txt"
131 |           - ".txt"
132 |           - ".doc"
133 |           - ".doc"
134 |           - ".docx"
135 |           - ".xls"
136 |           - ".xlsx"
137 |           - ".ppt"
138 |           - ".pptx"
139 |           - ".pdf"
140 |           - ".csv"
141 | 


--------------------------------------------------------------------------------