Backup File Scanner (HTTP) - Unreliable Detection Reporting

# SPDX-FileCopyrightText: 2020 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108975");
  script_version("2026-03-17T05:57:28+0000");
  script_tag(name:"last_modification", value:"2026-03-17 05:57:28 +0000 (Tue, 17 Mar 2026)");
  script_tag(name:"creation_date", value:"2020-10-26 12:13:27 +0000 (Mon, 26 Oct 2020)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"Mitigation");

  script_name("Backup File Scanner (HTTP) - Unreliable Detection Reporting");

  script_category(ACT_ATTACK);

  script_copyright("Copyright (C) 2020 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_http_backup_file_scan.nasl");
  script_mandatory_keys("http_backup_file_scan/started");

  # nb: This VT had a script preference with the id:1, newly added preferences in the future needs
  # to choose id:2 or higher to avoid conflicts with that removed preference still kept in gvmd
  # database.

  script_tag(name:"summary", value:"The script reports backup files left on the web server.");

  script_tag(name:"vuldetect", value:"Reports previous enumerated backup files accessible on the
  remote web server.

  Note: The checks done by the relevant script are time-consuming and have a limited scope so that
  script won't run by default. If you want to check for this vulnerability please enable 'Enable
  generic web application scanning' within the script preferences of the VT 'Global variable
  settings (OID: 1.3.6.1.4.1.25623.1.0.12288)'");

  script_tag(name:"insight", value:"Notes:

  - 'Unreliable Detection' means that a file was detected only based on a HTTP 200 (Found) status
  code reported by the remote web server when a file was requested.

  - As the VT 'Backup File Scanner (HTTP)' (OID: 1.3.6.1.4.1.25623.1.0.140853) might run into a
  timeout the actual reporting of this vulnerability takes place in this VT instead.");

  script_tag(name:"impact", value:"Based on the information provided in these files an attacker
  might be able to gather sensitive information stored in these files.");

  script_tag(name:"solution", value:"Delete the backup files.");

  script_xref(name:"URL", value:"https://www.openwall.com/lists/oss-security/2017/10/31/1");

  exit(0);
}

include("http_func.inc");
include("port_service_func.inc");

port = http_get_port(default: 80);
host = http_host_name(dont_add_port: TRUE);

findings = get_kb_list("www/" + host + "/" + port + "/content/backup_file_unreliable");
if (findings) {

  report = 'The following backup files were identified (<URL>:<Matching pattern>):\n';

  # Sort to not report changes on delta reports if just the order is different
  findings = sort(findings);

  foreach finding (findings) {
    url_pattern = split(finding, sep: "#-----#", keep: FALSE);
    if (!url_pattern || max_index(url_pattern) != 2)
      continue;

    url = url_pattern[0];
    pattern = url_pattern[1];

    report += '\n' + url + ":" + pattern;
    vuln = TRUE;
  }
}

if (vuln) {
  security_message(port: port, data: report);
  exit(0);
}

exit(99);