Discovery
Confirm backup and DVCS leaks on live application URLs
Checks live URLs for backup files and exposed version-control paths.
overview
What bfac does
bfac hunts deploy leftovers: editor backups, archives, and exposed DVCS directories such as .git. An open index.php.bak or .git/HEAD can leak source, secrets, and directory layout.
Point it at -u or --list. It generates candidate paths and verifies with --technique (status_code, content_length, or all) so soft-404s stay out. Raise -level for more permutations; --dvcs-test narrows to VCS; --request-rate-throttling caps pace.
Feed live endpoints from a crawler or prober, then route confirmed artifacts into the same triage path as other findings. The managed discovery node writes a file and a folder of hits from -u or --list input.
source github.com/mazen160/bfac
use cases
Where bfac fits
Find exposed backup copies of source
Check a host for editor and archive backups of live files so you catch a leaked index.php.bak before someone reads application source from it.
Hunt exposed version-control directories
Run --dvcs-test to focus on exposed .git and similar folders, the artifacts that most often leak an entire codebase and its history.
Sweep a list of discovered URLs
Pass a crawler's endpoint list via --list and check every path for backup artifacts in one pass instead of probing each by hand.
Verify hits without false positives
Use --technique status_code, content_length, or all so soft-404 pages are not reported as real backups.
reference
bfac inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| single-url | STRING | -u | Check a single URL for backup artifacts. |
| url-list | FILE | --list | Check a list of URLs, the usual pipeline input. |
| level | STRING | -level | Choose how aggressively bfac generates candidate paths. |
| verification-technique | STRING | --technique | Confirm hits by status_code, content_length, or all (default all). |
| dvcs-tests-only | BOOLEAN | --dvcs-test | Limit the run to exposed DVCS artifacts such as .git. |
| request-rate | STRING | --request-rate-throttling | Requests per second to throttle a run (default 30). |
| exclude-status-code | STRING | -xsc | Status codes to exclude, comma-separated. |
| cookie | STRING | --cookie | HTTP cookie header value, for authenticated checks. |
Showing key inputs. bfac exposes 18 inputs in total.
Full flag reference (18 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| host | STRING | --host | HTTP host header value |
| level | STRING | -level | Choose level |
| proxy | STRING | --proxy | Proxy authentication credentials (name:password). |
| cookie | STRING | --cookie | HTTP cookie header value |
| timeout | STRING | --timeout | HTTP request timeout in seconds (default:5) |
| url-list | FILE | --list | Check a list of URLs |
| proxy-file | FILE | --proxy-file | Use a proxy list file |
| single-url | STRING | -u | Check a single URL |
| user-agent | STRING | -ua | HTTP User-Agent header value |
| request-rate | STRING | --request-rate-throttling | Request rate throttling per second (default: 30) |
| results-only | BOOLEAN | --no-text | Show the results only |
| extra-headers | STRING | --headers | Extra headers (e.g. "Accept-Language: fr\nETag: 123") |
| dvcs-tests-only | BOOLEAN | --dvcs-test | Limit the test to exposed DVCS tests |
| user-agent-file | FILE | --user-agents-file | Use a User-Agents file |
| exclude-status-code | STRING | -xsc | Specify status codes to exclude, separated by commas |
| invalid-content-length | STRING | --invalid-content-length | Manually specify the invalid Content-Length, instead of performing this check automatically. |
| verification-technique | STRING | --technique | Technique to verify the availability of the file. (options: status_code, content_length, all) (default: all) |
| invalid-content-length-offset | STRING | --invalid-content-length-offset | Manually specify the Content-Length offset for invalid pages (default: 50). |
example
Run bfac
# check live URLs for backup and DVCS artifactsbfac --list urls.txt -level 4 --technique all --request-rate-throttling 20 --no-text[+] https://www.example.com/index.php.bak (200, content-length verified)[+] https://www.example.com/.git/HEAD (200)[+] https://api.example.com/app.tar.gz (200)[+] https://app.example.com/config.php~ (200)[+] https://staging.example.com/.svn/entries (200)[-] soft-404 candidates excluded via content_length[*] 5 artifacts confirmed across 40 URLsguidance
Choosing bfac
Reach for bfac when you have live URLs and want to know whether a deploy left backup or version-control files exposed. It checks known paths; it does not crawl. Feed endpoints from a crawler or prober. For broader secret hunting inside pages, pair it with a secret scanner.
gittools-finder
Focuses on exposed .git repositories. bfac covers DVCS plus editor and archive backups.
snallygaster
Scans for a wider set of secret files on web servers. bfac is tighter on backup artifacts.
ffuf
General content brute forcer. bfac ships backup-specific paths and verification logic.
faq
bfac questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run bfac yourself
A URL list is probed by httpx, then bfac checks each live path for backup and version-control artifacts and writes the confirmed hits as a queryable output.
Facts on this page come from the live Trickest tool library.