How do I check one URL vs a list?

Use -u for a single URL, or --list for a file of URLs. Raise -level when you want more candidate path permutations.

How does --technique reduce false positives?

bfac verifies each candidate by status code, content length, or both. Set --technique to status_code, content_length, or all (default) so soft-404 pages are not reported as real backups.

Can I limit the run to version-control leaks?

Yes. --dvcs-test limits the run to exposed DVCS artifacts, which is faster when you only care about leaked repositories.

How do I throttle requests?

Set --request-rate-throttling to cap requests per second (default 30). Use --timeout for hung connections.

What should feed bfac in a workflow?

A list of live URLs from a crawler or a prober such as httpx. bfac checks those paths for backups rather than discovering them itself.

Updated Jul 15, 2026

Discovery

Confirm backup and DVCS leaks on live application URLs

Checks live URLs for backup files and exposed version-control paths.

Find exposed backup copies of source Hunt exposed version-control directories Sweep a list of discovered URLs

overview

What bfac does

bfac hunts deploy leftovers: editor backups, archives, and exposed DVCS directories such as .git. An open index.php.bak or .git/HEAD can leak source, secrets, and directory layout.

Point it at -u or --list. It generates candidate paths and verifies with --technique (status_code, content_length, or all) so soft-404s stay out. Raise -level for more permutations; --dvcs-test narrows to VCS; --request-rate-throttling caps pace.

Feed live endpoints from a crawler or prober, then route confirmed artifacts into the same triage path as other findings. The managed discovery node writes a file and a folder of hits from -u or --list input.

source github.com/mazen160/bfac

use cases

Where bfac fits

Find exposed backup copies of source

Check a host for editor and archive backups of live files so you catch a leaked index.php.bak before someone reads application source from it.

Hunt exposed version-control directories

Run --dvcs-test to focus on exposed .git and similar folders, the artifacts that most often leak an entire codebase and its history.

Sweep a list of discovered URLs

Pass a crawler's endpoint list via --list and check every path for backup artifacts in one pass instead of probing each by hand.

Verify hits without false positives

Use --technique status_code, content_length, or all so soft-404 pages are not reported as real backups.

reference

bfac inputs and flags

18 inputs

Name	Type	Flag	Description
single-url	STRING	-u	Check a single URL for backup artifacts.
url-list	FILE	--list	Check a list of URLs, the usual pipeline input.
level	STRING	-level	Choose how aggressively bfac generates candidate paths.
verification-technique	STRING	--technique	Confirm hits by status_code, content_length, or all (default all).
dvcs-tests-only	BOOLEAN	--dvcs-test	Limit the run to exposed DVCS artifacts such as .git.
request-rate	STRING	--request-rate-throttling	Requests per second to throttle a run (default 30).
exclude-status-code	STRING	-xsc	Status codes to exclude, comma-separated.
cookie	STRING	--cookie	HTTP cookie header value, for authenticated checks.

Showing key inputs. bfac exposes 18 inputs in total.

Full flag reference (18 inputs)

Name	Type	Flag	Description
host	STRING	--host	HTTP host header value
level	STRING	-level	Choose level
proxy	STRING	--proxy	Proxy authentication credentials (name:password).
cookie	STRING	--cookie	HTTP cookie header value
timeout	STRING	--timeout	HTTP request timeout in seconds (default:5)
url-list	FILE	--list	Check a list of URLs
proxy-file	FILE	--proxy-file	Use a proxy list file
single-url	STRING	-u	Check a single URL
user-agent	STRING	-ua	HTTP User-Agent header value
request-rate	STRING	--request-rate-throttling	Request rate throttling per second (default: 30)
results-only	BOOLEAN	--no-text	Show the results only
extra-headers	STRING	--headers	Extra headers (e.g. "Accept-Language: fr\nETag: 123")
dvcs-tests-only	BOOLEAN	--dvcs-test	Limit the test to exposed DVCS tests
user-agent-file	FILE	--user-agents-file	Use a User-Agents file
exclude-status-code	STRING	-xsc	Specify status codes to exclude, separated by commas
invalid-content-length	STRING	--invalid-content-length	Manually specify the invalid Content-Length, instead of performing this check automatically.
verification-technique	STRING	--technique	Technique to verify the availability of the file. (options: status_code, content_length, all) (default: all)
invalid-content-length-offset	STRING	--invalid-content-length-offset	Manually specify the Content-Length offset for invalid pages (default: 50).

example

Run bfac

bfac · command

# check live URLs for backup and DVCS artifactsbfac --list urls.txt -level 4 --technique all --request-rate-throttling 20 --no-text

sample output

[+] https://www.example.com/index.php.bak (200, content-length verified)[+] https://www.example.com/.git/HEAD (200)[+] https://api.example.com/app.tar.gz (200)[+] https://app.example.com/config.php~ (200)[+] https://staging.example.com/.svn/entries (200)[-] soft-404 candidates excluded via content_length[*] 5 artifacts confirmed across 40 URLs

guidance

Choosing bfac

Reach for bfac when you have live URLs and want to know whether a deploy left backup or version-control files exposed. It checks known paths; it does not crawl. Feed endpoints from a crawler or prober. For broader secret hunting inside pages, pair it with a secret scanner.

gittools-finder

Focuses on exposed .git repositories. bfac covers DVCS plus editor and archive backups.

snallygaster

Scans for a wider set of secret files on web servers. bfac is tighter on backup artifacts.

ffuf

General content brute forcer. bfac ships backup-specific paths and verification logic.

faq

bfac questions

Editor and archive backups of live files, plus exposed version-control directories such as .git. Those are the files most likely to disclose source, passwords, and directory structure.

Run bfac yourself

A URL list is probed by httpx, then bfac checks each live path for backup and version-control artifacts and writes the confirmed hits as a queryable output.

Run bfac in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

single-url

STRING

-u

Check a single URL for backup artifacts.

url-list

FILE

--list

Check a list of URLs, the usual pipeline input.

level

STRING

-level

Choose how aggressively bfac generates candidate paths.

verification-technique

STRING

--technique

Confirm hits by status_code, content_length, or all (default all).

dvcs-tests-only

BOOLEAN

--dvcs-test

Limit the run to exposed DVCS artifacts such as .git.

request-rate

STRING

--request-rate-throttling

Requests per second to throttle a run (default 30).

exclude-status-code

STRING

-xsc

Status codes to exclude, comma-separated.

STRING

--cookie

HTTP cookie header value, for authenticated checks.

Name

Type

Flag

Description

host

STRING

--host

HTTP host header value

level

STRING

-level

Choose level

proxy

STRING

--proxy

Proxy authentication credentials (name:password).

STRING

--cookie

HTTP cookie header value

timeout

STRING

--timeout

HTTP request timeout in seconds (default:5)

url-list

FILE

--list

Check a list of URLs

proxy-file

FILE

--proxy-file

Use a proxy list file

single-url

STRING

-u

Check a single URL

user-agent

STRING

-ua

HTTP User-Agent header value

request-rate

STRING

--request-rate-throttling

Request rate throttling per second (default: 30)

results-only

BOOLEAN

--no-text

Show the results only

extra-headers

STRING

--headers

Extra headers (e.g. "Accept-Language: fr\nETag: 123")

dvcs-tests-only

BOOLEAN

--dvcs-test

Limit the test to exposed DVCS tests

user-agent-file

FILE

--user-agents-file

Use a User-Agents file

exclude-status-code

STRING

-xsc

Specify status codes to exclude, separated by commas

invalid-content-length

STRING

--invalid-content-length

Manually specify the invalid Content-Length, instead of performing this check automatically.

verification-technique

STRING

--technique

Technique to verify the availability of the file. (options: status_code, content_length, all) (default: all)

invalid-content-length-offset

STRING

--invalid-content-length-offset

Manually specify the Content-Length offset for invalid pages (default: 50).

[+] https://www.example.com/index.php.bak (200, content-length verified)[+] https://www.example.com/.git/HEAD (200)[+] https://api.example.com/app.tar.gz (200)[+] https://app.example.com/config.php~ (200)[+] https://staging.example.com/.svn/entries (200)[-] soft-404 candidates excluded via content_length[*] 5 artifacts confirmed across 40 URLs

Confirm backup and DVCS leaks on live application URLs

What bfac does

Where bfac fits

Find exposed backup copies of source

Hunt exposed version-control directories

Sweep a list of discovered URLs

Verify hits without false positives

bfac inputs and flags

Run bfac

Choosing bfac

gittools-finder

snallygaster

ffuf

bfac questions

More Discovery tools

apkurlgrep

dirsearch

fallparams

feroxbuster

gauplus

getJS

Run bfac yourself

Confirm backup and DVCS leaks on live application URLs

What bfac does

Where bfac fits

Find exposed backup copies of source

Hunt exposed version-control directories

Sweep a list of discovered URLs

Verify hits without false positives

bfac inputs and flags

Run bfac

Choosing bfac

gittools-finder

snallygaster

ffuf

bfac questions

More Discovery tools

apkurlgrep

dirsearch

fallparams

feroxbuster

gauplus

getJS

Run bfac yourself