Old backup and unreferenced files

From the naming scheme used for published content, it is often possible to infer the name and location of unreferenced pages. For example, if a page viewuser. Many web applications leave clues in published content that can lead to the discovery of hidden pages and functionality. The source code for all published content should be manually reviewed to identify clues about other pages and functionality.

For example:. In its simplest form, this involves running a list of common file names through a request engine in an attempt to guess files and directories that exist on the server. The following netcat wrapper script will read a wordlist from stdin and perform a basic guessing attack:.

But also look out for Moved , Found , Unauthorized , Forbidden and Internal error , which may also indicate resources or directories that are worthy of further investigation. The basic guessing attack should be run against the webroot, and also against all directories that have been identified through other enumeration techniques. The most obvious way in which a misconfigured server may disclose unreferenced pages is through directory listing.

Request all enumerated directories to identify any which provide a directory listing. The very real threat of information disclosure by means of inadvertent exposure of sensitive files has been a constant source of woe for corporations and individuals alike. Despite having the potential for serious repercussions including legal ones, many webmasters, administrators and developers have struggled to contain this common issue for years.

This article explores various manifestations of related issues, gives readers a glance at the modi operandi of real-world attackers trying to exploit them, and provides guidance on how to protect a website against file based information leakage.

One of the most common examples of backup files exposing sensitive information may be that of the backup copy of a. A server administrator planning to modify a configuration file, such as wp-config. Although clearly not best practice, this exact behaviour can be observed in the wild on a regular basis.

As the name suggests, backup and unreferenced files are actual backups taken that can either be backups of particular files, typically created when editing files such as configuration files, or even full backups.

Understanding what these backup files are and how they are generated is the first step we need to take to address the problem. There are many reasons why you might need to edit WordPress files. Of course, because such mistakes are easy to make, it is not advisable to edit files directly on production web servers.

Best practices tell us to first test any changes in a testing or staging server. In real life, however, best practices are not always followed. The process of downloading the file, making the changes, testing, and re-uploading can take considerably longer than editing the file on the live server. We have all been there.

Editing on the live server can be very easy. However, that backup file left in the folder just in case, you know can end up being the source of many aches and pains. Chances are pretty much anyone can download it and with it the entire configuration, in plain text, no less. Moreover, many WordPress administrators may not be aware that editing files in place using a file editor such as Vim may automatically create backup, recovery, and lock files.

Vim creates these files to allow you to recover your work if Vim crashes or quits unexpectedly. While this is unquestionably a valuable feature to have, this also means that you may inadvertently end up with backup files you never intended to create sprinkled around your website, waiting for anyone to access. Equally, backups of entire directories left in a public folder can be as damaging. While taking backups of your WordPress website is critical, this needs to be done safely without introducing new security risks.

We will talk about this in more detail later in this article. Common examples of backup files include renamed old versions of modified configuration files, PHP files or other source code, and automatic or manual backups in the form of compressed archives such as.

On the other hand, unreferenced files are misplaced files that, due to a configuration or design decision, end up somewhere where they do not belong. This vulnerability can also occur if the administrator is zipping a set of files to create a backup in the web root. Old files that contain some vulnerabilities but in the up-to-date versions it have been fixed consider about.

Backup files can be used to restore the file system in the server. This file may disclose the source code for pages design to the server if an attacker can requesting about. Files that contain or leak sensitive information that can help an attacker to focused attack toward the application such as absolute file paths, files configuration including references to other hidden content, include files containing database credentials, etc.

Explore more. Check your website security today and.