Professional Community

Backup Finder

A burp suite extension that reviews backup, old, temporary, and unreferenced files on the webserver for sensitive information.

OWASP references:

  • Classification: Web Application Security Testing > 02-Configuration and Deployment Management Testing
  • OTG v4: OWASP OTG-CONFIG-004
  • WSTG: WSTG-CONF-04

Why would I use this extension?

As I analyzed some of "backup finder" tools, I realized that almost all of the available tools use only static payloads (they use built-in dictionaries) and they don't generate dynamic payloads based on target which is being tested.

This extension will find all backup, old and temp files in this scenario:

  • /upload/index.php~ (Dynamic, finds possible extension and index file)
  • /upload/index.php.bkup (Dynamic, finds possible extension and index file)
  • /upload/upload.zip (Dynamic, using current dir name)
  • /upload/users/catalog.zip (Static, using dictionary)
  • /WeirdDirName.tar.gz (Dynamic, using child dir name)
  • /WeirdDirName/captcha.php.old (Dynamic, using current dir name)

Quick Start

  1. Select a request of a target host from any tab of the burp suite
  2. In "backupFinder -> Finder -> options" tab, apply your configurations.
  3. Go to "backupFinder -> Finder -> Finder" tab and click on "start" button.

Fine Tuning (To have the best results)

This extension uses the datas in the target tab (which are collected actively or passively) under the domain name that you call extension for as its feed. to have the best result, it's recommended that you first do these steps before starting the extension process:

  • Crawl the domain actively using the Burpsuite crawler. (in the target tab: right click on the domain -> scan -> crawl only)
  • If the application needs authentication, login via browser and submit the forms to see if there are more files or directories to be listed under our target.

Author

Author

Moein Fatehi

Version

Version

0.2

Rating

Rating

Popularity

Popularity

Last updated

Last updated

04 August 2022

Estimated system impact

Estimated system impact

Overall impact: Empty

Memory
Empty
CPU
Empty
General
Empty
Scanner
Empty

You can install BApps directly within Burp, via the BApp Store feature in the Burp Extender tool. You can also download them from here, for offline installation into Burp.

You can view the source code for all BApp Store extensions on our GitHub page.

Follow @BApp_Store on Twitter to receive notifications of all BApp releases and updates.

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.

Go back to BappStore

Note:

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.