loading
Loading content
loading
Vulnerability Scanning
Hunt hostname-named backup files like .bak, .sql, zip, and tarball dumps on a URL list. Heuristics cut false positives so hits are real archives.
Exposed backup files are .bak, .sql, zip, and tarball dumps left on the web root that leak source code, database exports, or application logs. This backup file scanner builds hostname-derived wordlists a generic dirbust misses, then runs heuristics to cut false positives across thousands of servers. A hit is a candidate archive, not certified contents.
You feed a list of live URLs. This module builds hostname-derived names and
looks for backup dumps and archives left in the web root: .bak, .sql, zip,
and tarball. A hit is a candidate archive, not a certified dump of source or
the database. A backup may contain source, a database dump, or logs; that is
payload, not a second scan class.
Probe for Web Servers
writes the URL list. Optionally nest
Discover Paths via Crawling
or
Discover Paths via Directory Brute Force
first so the prefixes you hand this module are deeper than /.
findings into
Generate Scan Report.
Nest the four exposure modules on the same URL list after probe: admin panels, this page, secrets, and sensitive files. Same face, four artifact classes. Do not share one H1.
Nest this after you have live web URLs and you want hostname-named backup dumps that a generic path wordlist will miss. A root-only list only tries those names at the prefixes you already have. Crawl or directory brute force first if you need deeper path prefixes under the same hosts.
urls (FILE): live web URLs, one per line. Example: https://foo.example.com.
header (STRING): header(s) to include in HTTP requests.
header-file (FILE): the same headers, from a file.
rate-limit (STRING, default 300 per second per machine): a ceiling, not
findings (FILE): JSONLines. Each row carries finding, location, severity,
The tables this module produces. Sample rows are illustrative.
Candidate backup dumps and archives left in the web root, hostname-named.
findingtext | locationurl | severitytext | hostnametext | domain_nametext | methodtext | descriptiontext | |
|---|---|---|---|---|---|---|---|
| 1 | Exposed Backup File | https://app.example.com/app.zip | unknown | app.example.com | example.com | GET | Hostname-named zip archive (123.4 MB) served from the web root. |
| 2 | Exposed Backup File | https://www.example.com/www.sql.tar.gz | unknown | www.example.com | example.com | GET | Hostname-named SQL tarball (567.8 MB) served from the web root. |
| 3 | Exposed Backup File | https://db.example.com/db.bak | unknown | db.example.com | example.com | GET | Hostname-named .bak archive served from the web root. |
Artifact class it owns
Management / login UI; default creds on a subset
Upstream it needs
live urls
Scan for Exposed Backups
Artifact class it owns
Hostname-named .bak/.sql/zip/tarball
Upstream it needs
live urls
Artifact class it owns
Patterns in the response you fetched
Upstream it needs
live urls
Artifact class it owns
.env, .git/config, logs, dev artifacts
Upstream it needs
live urls
questions
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.