nuclei-templates/php-backup-files.yaml at main · sethbdev/nuclei-templates · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
id: php-backup-files

info:
  name: PHP Source - Backup File Information Disclosure
  author: StreetOfHackerR007,pwnhxl,mastercho,0xpugazh
  severity: medium
  metadata:
    max-request: 1222
  tags: exposure,backup,php,disclosure,fuzz

http:
  - method: GET
    path:
      - "{{BaseURL}}{{filepath}}{{bakext}}"

    attack: clusterbomb
    payloads:
      filepath:
        - /wp-config.php # wordpress
        - /wp-config # wordpress
        - /site/default/settings.php # drupal
        - /installation/configuration.php # joomla
        - /app/etc/env.php # magento
        - /Application/Common/Conf/config.php # thinkphp
        - /environments/dev/common/config/main-local.php # yii
        - /environments/prod/common/config/main-local.php # yii
        - /common/config/main-local.php # yii
        - /system/config/default.php # opencart
        - /typo3conf/localconf.php # typo3
        - /config/config_global.php # discuz
        - /config/config_ucenter.php # discuz
        - /textpattern/config.php # textpattern
        - /data/common.inc.php # dedecms
        - /caches/configs/database.php # phpcms
        - /caches/configs/system.php # phpcms
        - /include/config.inc.php # phpcms
        - /include/config.php # xbtit
        - /includes/config.php # vbulletin
        - /includes/config # vbulletin
        - /phpsso_server/caches/configs/database.php # phpcms
        - /phpsso_server/caches/configs/system.php # phpcms
        - /zb_users/c_option.php # zblog
        - /e/class/config.php # empirecms
        - /e/config/config.php # empirecms
        - /data/sql_config.php # phpwind
        - /data/bbscache/config.php # phpwind
        - /db.php
        - /conn.php
        - /database.php
        - /db_config.php
        - /config.inc.php
        - /data/config.php
        - /config/config.php
        - /index.php
        - /default.php
        - /main.php
        - /settings.php
        - /header.php
        - /footer.php
        - /login.php
        - /404.php
        - /wp-login.php
        - /config.php
        - /config
        - /const.DB.php.bak
      bakext:
        - ".~"
        - ".bk"
        - ".bak"
        - ".bkp"
        - ".BAK"
        - ".swp"
        - ".swo"
        - ".swn"
        - ".tmp"
        - ".save"
        - ".old"
        - ".new"
        - ".orig"
        - ".dist"
        - ".txt"
        - ".disabled"
        - ".original"
        - ".backup"
        - "_bak"
        - "_1.bak"
        - "~"
        - "!"
        - ".0"
        - ".1"
        - ".2"
        - ".3"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "<?php"
          - "<?="
        condition: or

      - type: word
        part: body
        words:
          - "?>"
          - "($"
          - "$_GET["
          - "$_POST["
          - "$_REQUEST["
          - "$_SERVER["
          - "'DB_PASSWORD'"
          - "'DBPASS'"
          - "define('DB"
        condition: or

      - type: word
        part: header
        words:
          - "text/plain"
          - "bytes"
        condition: or