Backup Finder

A burp suite extension that reviews backup, old, temporary, and unreferenced files on the webserver for sensitive information.

OWASP references:

• Classification: Web Application Security Testing > 02-Configuration and Deployment Management Testing
• OTG v4: OWASP OTG-CONFIG-004
• WSTG: WSTG-CONF-04

Why would I use this extension?

As I analyzed some of "backup finder" tools, I realized that almost all of the available tools use only static payloads (they use built-in dictionaries) and they don't generate dynamic payloads based on target which is being tested.

This extension will find all backup, old and temp files in this scenario:

• /upload/index.php~ (Dynamic, finds possible extension and index file)
• /upload/index.php.bkup (Dynamic, finds possible extension and index file)
• /upload/upload.zip (Dynamic, using current dir name)
• /upload/users/catalog.zip (Static, using dictionary)
• /WeirdDirName.tar.gz (Dynamic, using child dir name)
• /WeirdDirName/captcha.php.old (Dynamic, using current dir name)

Quick Start

1. Select a request of a target host from any tab of the burp suite
2. In "backupFinder -> Finder -> options" tab, apply your configurations.
3. Go to "backupFinder -> Finder -> Finder" tab and click on "start" button.

Fine Tuning (To have the best results)

This extension uses the datas in the target tab (which are collected actively or passively) under the domain name that you call extension for as its feed. to have the best result, it's recommended that you first do these steps before starting the extension process:

• Crawl the domain actively using the Burpsuite crawler. (in the target tab: right click on the domain -> scan -> crawl only)
• If the application needs authentication, login via browser and submit the forms to see if there are more files or directories to be listed under our target.