Why hostname-derived names?

Because a generic path wordlist will not contain `{{host}}.zip`. Naming the backup after the host is a common operator habit. The module builds the wordlist from the hostname for that reason.

Is a hit confirmed source code?

No. A hit is a candidate that passed the heuristics. A 123.4 MB `foo.zip` may be source, a database dump, logs, or something else. Open it in triage before you claim what it contains.

A backup file may contain application logs. That is possible payload, not a second hunt. Live log files on the web root are [Scan for Sensitive Files](/library/modules/scan-for-sensitive-files).

Does recursion replace a dirbust?

No. v1.2.0 walks prefixes of the URLs you already supplied. If you need unlinked `/backups` under a path you never listed, that is directory brute force, then this module.

What backup file types does it find?

`.bak`, `.sql`, zip, and tarball archives, often named after the host (`foo.zip`, `www.sql.tar.gz`). The hostname-derived wordlist is what reaches names a generic wordlist will not have.

How does it avoid false positives?

Heuristics analyze the brute-force results. v1.0.1 killed `text/plain` false hits where a 200 was not an archive. A 200 is not a backup; the heuristics are the filter, and they are not a guarantee of contents.

2026-08-13

Vulnerability Scanning

Scan for Exposed Backups

Hunt hostname-named backup files like .bak, .sql, zip, and tarball dumps on a URL list. Heuristics cut false positives so hits are real archives.

What Scan for Exposed Backups does

Exposed backup files are .bak, .sql, zip, and tarball dumps left on the web root that leak source code, database exports, or application logs. This backup file scanner builds hostname-derived wordlists a generic dirbust misses, then runs heuristics to cut false positives across thousands of servers. A hit is a candidate archive, not certified contents.

You feed a list of live URLs. This module builds hostname-derived names and looks for backup dumps and archives left in the web root: .bak, .sql, zip, and tarball. A hit is a candidate archive, not a certified dump of source or the database. A backup may contain source, a database dump, or logs; that is payload, not a second scan class.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Probe for Web Servers writes the URL list. Optionally nest Discover Paths via Crawling or Discover Paths via Directory Brute Force first so the prefixes you hand this module are deeper than /.

Downstream

findings into Generate Scan Report.

Parallel

Nest the four exposure modules on the same URL list after probe: admin panels, this page, secrets, and sensitive files. Same face, four artifact classes. Do not share one H1.

When to use this

Nest this after you have live web URLs and you want hostname-named backup dumps that a generic path wordlist will miss. A root-only list only tries those names at the prefixes you already have. Crawl or directory brute force first if you need deeper path prefixes under the same hosts.

Inputs and outputs

Required: urls (FILE): live web URLs, one per line. Example: https://foo.example.com.
Optional: header (STRING): header(s) to include in HTTP requests.
header-file (FILE): the same headers, from a file.
rate-limit (STRING, default 300 per second per machine): a ceiling, not
findings (FILE): JSONLines. Each row carries finding, location, severity,

Data

The tables this module produces. Sample rows are illustrative.

findings7 columns · 3 sample rows

Candidate backup dumps and archives left in the web root, hostname-named.

	findingtext	locationurl	severitytext	hostnametext	domain_nametext	methodtext	descriptiontext
1	Exposed Backup File	https://app.example.com/app.zip	unknown	app.example.com	example.com	GET	Hostname-named zip archive (123.4 MB) served from the web root.
2	Exposed Backup File	https://www.example.com/www.sql.tar.gz	unknown	www.example.com	example.com	GET	Hostname-named SQL tarball (567.8 MB) served from the web root.
3	Exposed Backup File	https://db.example.com/db.bak	unknown	db.example.com	example.com	GET	Hostname-named .bak archive served from the web root.

How it differs from similar modules

Find web admin panels and check them for default credentials

Artifact class it owns

Management / login UI; default creds on a subset

Upstream it needs

live urls

Scan for Exposed Backups

Artifact class it owns

Hostname-named .bak/.sql/zip/tarball

Upstream it needs

live urls

Find tokens and credentials in live HTTP responses

Artifact class it owns

Patterns in the response you fetched

Upstream it needs

live urls

Scan for exposed config files and logs

Artifact class it owns

.env, .git/config, logs, dev artifacts

Upstream it needs

live urls

questions