소스 정보
- 저장소
- CyberStrikeus/CyberStrike
- 최근 소스 활동
- 2026년 4월 28일 23:54
- 감지된 SKILL.md 언어
- 영어
- 스타
- 1,653
- 포크
- 254
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-03명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-conf-03 |
| description | Test File Extensions Handling for Sensitive Information |
| category | configuration |
| owasp_id | WSTG-CONF-03 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["misconfiguration","hardening","server","wstg","conf"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CONF-03
Test File Extensions Handling for Sensitive Information
This test examines how the web server handles different file extensions. Misconfigured servers may expose source code, include files, backup files, or other sensitive content when requested with specific extensions. Attackers exploit these misconfigurations to access database credentials, API keys, and other sensitive information stored in files that should never be served directly.
# Spider the site to find existing files
wget --spider -r -l 3 https://target.com 2>&1 | grep -oP 'https?://[^\s]+' > urls.txt
# Extract unique extensions
cat urls.txt | grep -oP '\.[a-zA-Z0-9]+$' | sort -u
BASE_FILE=
ext \
.bak .backup .old .orig .save .swp .tmp \
.txt .inc .src .dev . \
.php~ .php.bak .php.old .php.save \
.1 .2 _backup _old _copy;
test_file=
status=$(curl -s -o /dev/null -w )
[ == ];
# Extensions that should never be served
dangerous_exts=(".inc" ".config" ".conf" ".cfg" ".ini"
".sql" ".db" ".sqlite" ".mdb"
".log" ".bak" ".backup" ".old"
".asa" ".asax" ".ascx" ".ashx" ".asmx"
".yml" ".yaml" ".json" ".xml"
".env" ".htaccess" ".htpasswd")
for ext in "${dangerous_exts[@]}"; do
# Test common filenames with this extension
for name in config database connection settings credentials secrets; do
test_file="${name}${ext}"
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$test_file")
if [ "$status" == "200" ]; then
echo "FOUND: $test_file"
fi
done
done
# Common include file patterns
includes=("connection.inc" "config.inc" "database.inc" "db.inc"
"conn.inc" "settings.inc" "common.inc" "global.inc"
"init.inc" "functions.inc" "class.inc")
for file in "${includes[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$file")
if [ "$status" == "200" ]; then
echo "INCLUDE FILE FOUND: $file"
# Check content for sensitive data
curl -s "https://target.com/$file" | head -50
fi
done
# Git directory
curl -s https://target.com/.git/config
curl -s https://target.com/.git/HEAD
curl -s https://target.com/.git/index
# SVN directory
curl -s https://target.com/.svn/entries
curl -s https://target.com/.svn/wc.db
# If .git is accessible, dump repository
# git-dumper (https://github.com/arthaud/git-dumper)
git-dumper https://target.com/.git/ output_dir/
# Test case variations (especially on Windows/IIS)
original="config.php"
variations=("Config.php" "CONFIG.PHP" "config.PHP" "CONFIG.php"
"config.Php" "cOnFiG.pHp")
for var in "${variations[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$var")
echo "$var: $status"
done
# Double extension bypass attempts
for ext in .php .asp .aspx .jsp; do
test_files=(
"file${ext}.txt"
"file${ext}.jpg"
"file.txt${ext}"
"file${ext}."
"file${ext}::DATA" # NTFS alternate data stream
)
for file in "${test_files[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$file")
echo "$file: $status"
done
done
# Windows short filename exploitation
# If file exists as "configuration.php", test:
short_names=("CONFIG~1.PHP" "CONFIG~1.PHT" "SHELL~1.PHP")
for name in "${short_names[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$name")
echo "$name: $status"
done
# Null byte injection (older systems)
curl -s "https://target.com/config.php%00.txt"
curl -s "https://target.com/config.php%00.jpg"
| Tool | Description | Usage |
|---|---|---|
| Nikto | Web scanner | nikto -h target.com |
| Dirb | Directory brute-force | dirb https://target.com |
| Gobuster | Directory/file enumeration | gobuster dir -u target.com -w wordlist.txt -x bak,old,txt |
| ffuf | Fast fuzzer | ffuf -u target.com/FUZZ -w wordlist.txt |
| Tool | Description | Usage |
|---|---|---|
| git-dumper | Git repository extraction | git-dumper url output/ |
| svn-extractor | SVN extraction | Extract SVN repos |
| GitTools | Git exploitation | Multiple tools |
#!/bin/bash
TARGET=$1
BASE_PATH=$2 # e.g., /includes/
echo "=== FILE EXTENSION HANDLER TEST ==="
# Dangerous extensions
dangerous=(".inc" ".config" ".conf" ".cfg" ".ini" ".env"
".sql" ".db" ".sqlite" ".log" ".bak" ".backup"
".old" ".save" ".swp" ".tmp" ".orig")
# Common filenames
filenames=("config" "database" "db" "connection" "conn"
"settings" "credentials" "secrets" "password"
"backup" "dump" "export" "import")
# Test combinations
for name in "${filenames[@]}"; do
for ext in "${dangerous[@]}"; do
file="${name}${ext}"
url="https://$TARGET$BASE_PATH$file"
status=$(curl -s -o /dev/null -w "%{http_code}" "$url")
if [ "$status" == "200" ]; then
echo "[CRITICAL] FOUND: $url"
# Show first 10 lines
curl -s "$url" | head -10
echo "---"
fi
done
done
# Test for backup extensions on known files
echo "[+] Testing backup extensions..."
known_files=("index.php" "config.php" "database.php" "wp-config.php")
backup_exts=(".bak" ".backup" ".old" ".save" "~" ".orig" ".1" ".2")
for file in "${known_files[@]}"; do
for ext in "${backup_exts[@]}"; do
test_url="https://$TARGET/${file}${ext}"
status=$(curl -s -o /dev/null -w "%{http_code}" "$test_url")
if [ "$status" == "200" ]; then
echo "[HIGH] BACKUP FOUND: $test_url"
fi
done
done
# Version control
echo "[+] Checking version control..."
vc_files=(".git/config" ".git/HEAD" ".svn/entries" ".svn/wc.db"
".hg/hgrc" ".bzr/README" "CVS/Root")
for file in "${vc_files[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET/$file")
if [ "$status" == "200" ]; then
echo "[CRITICAL] VERSION CONTROL EXPOSED: $file"
fi
done
echo "[+] Scan complete"
# Scan with multiple extensions
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-x php,bak,old,txt,inc,config,sql,log,backup,env \
-o gobuster_results.txt
# Specifically for backup files
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-x bak,backup,old,save,orig,swp,tmp,1,2 \
-o backup_files.txt
# Fuzz file extensions
ffuf -u https://target.com/config.FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt \
-mc 200
# Fuzz filename with extension
ffuf -u https://target.com/FUZZ.bak \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-mc 200
# Block specific extensions
<FilesMatch "\.(inc|config|sql|bak|backup|old|log|env)$">
Require all denied
</FilesMatch>
# Block backup patterns
<FilesMatch "(\.(bak|backup|old|save|swp|tmp)|~)$">
Require all denied
</FilesMatch>
# Block version control
<DirectoryMatch "^\.|\/\.">
Require all denied
</DirectoryMatch>
# Block dangerous extensions
location ~* \.(inc|config|sql|bak|backup|old|log|env)$ {
deny all;
return 404;
}
# Block backup files
location ~* \.(bak|backup|old|save|swp|tmp)$ {
deny all;
}
# Block version control
location ~ /\. {
deny all;
}
<system.webServer>
<security>
<requestFiltering>
<fileExtensions>
<add fileExtension=".inc" allowed="false" />
<add fileExtension=".config" allowed="false" />
<add fileExtension=".sql" allowed="false" />
<add fileExtension=".bak" allowed="false" />
<add fileExtension=".log" allowed="false" />
</fileExtensions>
<hiddenSegments>
<add segment=".git" />
<add segment=".svn" />
</hiddenSegments>
</requestFiltering>
</security>
</system.webServer>
# Keep sensitive files outside web root
/var/www/html/ <- Web root (public)
/var/www/includes/ <- Include files (outside web root)
/var/www/config/ <- Configuration (outside web root)
# PHP include path
include('/var/www/includes/database.php');
# Find and remove backup files
find /var/www/html -name "*.bak" -delete
find /var/www/html -name "*.backup" -delete
find /var/www/html -name "*.old" -delete
find /var/www/html -name "*~" -delete
find /var/www/html -name "*.swp" -delete
// Use .php extension for include files
// Instead of: database.inc
// Use: database.inc.php
// This ensures PHP processes the file instead of serving it
| Finding | CVSS | Severity |
|---|---|---|
| Source code disclosure | 7.5 | High |
| Database credentials in .inc | 9.8 | Critical |
| .git directory exposed | 9.8 | Critical |
| Backup files with credentials | 9.8 | Critical |
| Configuration file readable | 7.5-9.8 | High-Critical |
| SQL dump accessible | 9.8 | Critical |
Typical Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| CWE ID | Title | Description |
|---|---|---|
| CWE-200 | Information Exposure | Sensitive file disclosure |
| CWE-219 | Storage of File with Sensitive Data Under Web Root | Files in wrong location |
| CWE-530 | Exposure of Backup File to an Unauthorized Control Sphere | Backup file exposure |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File | Config in public files |
[ ] Known file extensions identified
[ ] Alternative extensions tested (.bak, .old, etc.)
[ ] Include files (.inc) checked
[ ] Configuration files tested
[ ] Backup files scanned
[ ] Version control directories checked (.git, .svn)
[ ] Case sensitivity tested
[ ] Double extensions tested
[ ] Null byte injection tested (legacy)
[ ] Windows 8.3 names tested
[ ] Source code disclosure verified
[ ] Sensitive data exposure documented
[ ] Risk ratings assigned
[ ] Remediation recommendations provided