Backup Hunter

Backup file exposure is a widespread web application vulnerability where developers or administrators accidentally leave backup copies of sensitive files accessible on production web servers. These forgotten files often contain credentials, source code, configuration details, and other information that was never intended to be publicly accessible. Discovering and exploiting these files is a fundamental reconnaissance technique in cybersecurity assessments.

How Backup Files End Up on Web Servers

Backup files are created through various means - text editors like Vim automatically generate .swp swap files, developers manually create copies with extensions like .bak or .old before making changes, and deployment scripts sometimes leave behind previous versions. Common backup file patterns include file.php.bak, config.old, settings.php~, .file.swp, and compressed archives like backup.zip or source.tar.gz. When these files reside within the web server's document root, they become accessible to anyone who knows or guesses their paths.

Techniques for Finding Backup Files

Security professionals use several methods to discover exposed backup files. Directory brute-forcing tools like Gobuster, ffuf, and Dirbuster systematically test common backup file names and extensions against a target server. Manual testing involves appending known backup extensions to discovered file paths. Google dorking can reveal indexed backup files through search engine queries. Analyzing robots.txt and sitemap files sometimes inadvertently discloses backup locations.

Security Impact and Prevention

Exposed backup files can lead to severe consequences including credential theft, source code disclosure revealing additional vulnerabilities, and exposure of internal network architecture. In real-world penetration tests, backup file discovery frequently provides the initial foothold that leads to full system compromise. Prevention requires configuring web servers to block access to backup file patterns, storing backups outside the web root, using proper deployment pipelines, and regularly scanning for accidentally exposed files.