1. id: zip-backup-files
    3. info:
    4.   name: Compressed Backup File - Detect
    5.   author: toufik-airane,dwisiswant0,ffffffff0x,pwnhxl,mastercho
    6.   severity: medium
    7.   description: Multiple compressed backup files were detected.
    8.   classification:
    9.     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    10.     cvss-score: 5.3
    11.     cwe-id: CWE-200
    12.   metadata:
    13.     max-request: 1440
    14.   tags: exposure,backup
    16. http:
    17.   - method: GET
    18.     path:
    19.       - "{{BaseURL}}/{{FILENAME}}.{{EXT}}"
    21.     attack: clusterbomb
    22.     payloads:
    23.       FILENAME:
    24.         - "{{FQDN}}" # www.example.com
    25.         - "{{RDN}}" # example.com
    26.         - "{{DN}}" # example
    27.         - "{{SD}}" # www
    28.         - "{{date_time('%Y')}}" # 2023
    29.         - "ROOT" # tomcat
    30.         - "www"
    31.         - "release"
    32.         - "bin"
    33.         - "bak"
    34.         - "web"
    36.       EXT:
    37.         - "tar"
    38.         - "rar"
    39.         - "tar.gz"
    40.         - "zip"
    41.     max-size: 500 # Size in bytes - Max Size to read from server response
    43.     matchers-condition: and
    44.     matchers:
    45.       - type: binary
    46.         binary:
    47.           - "7573746172202000" # tar
    48.           - "7573746172003030" # tar
    49.           - "377ABCAF271C" # 7z
    50.           - "1f8b" # gz tar.gz
    51.           - "526172211A0700" # rar RAR archive version 1.50
    52.           - "526172211A070100" # rar RAR archive version 5.0
    53.           - "FD377A585A0000" # xz tar.xz
    54.           - "4C5A4950" # lz
    55.           - "504B0304" # zip
    56.         condition: or
    57.         part: body
    59.       - type: regex
    60.         regex:
    61.           - "application/[-\\w.]+"
    62.         part: header
    64.       - type: status
    65.         status:
    66.           - 200
    67. # digest: 4a0a00473045022100d7a028dbd5f7ea1cf187e1871d5065d2cd4d6ef130b04b73088820d6072435f50220673ba2cf4b143fa0d6b4b9b18d0d6290d902f76df58c73c764f7a99ccc1c671f:922c64590222798bb761d5b6d8e72950