SQL Server - Dump Files

ID: sql-server-dump

Severity: medium

Author: userdehghani

Tags: exposure,backup,sql-server

Description

A SQL Server dump file was found

YAML Source

id: sql-server-dump

info:
  name: SQL Server - Dump Files
  author: userdehghani
  severity: medium
  description: |
    A SQL Server dump file was found
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
  metadata:
    max-request: 21
  tags: exposure,backup,sql-server

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"

    payloads:
      paths:
        - "/sa.bak"
        - "/wwwroot.bak"
        - "/backup.bak"
        - "/database.bak"
        - "/data.bak"
        - "/db_backup.bak"
        - "/dbdump.bak"
        - "/db.bak"
        - "/dump.bak"
        - "/{{Hostname}}.bak"
        - "/{{Hostname}}_db.bak"
        - "/localhost.bak"
        - "/mysqldump.bak"
        - "/mysql.bak"
        - "/site.bak"
        - "/sql.bak"
        - "/temp.bak"
        - "/translate.bak"
        - "/users.bak"
        - "/www.bak"
        - "/wp-content/uploads/dump.bak"
        - "/wp-content/mysql.bak"

    headers:
      Range: "bytes=0-500"
    max-size: 500 # Size in bytes - Max Size to read from server response

    matchers-condition: and
    matchers:
      - type: binary
        part: body
        binary:
          - "54415045" # Microsoft Tape Format

      - type: status
        status:
          - 200
# digest: 490a004630440220611633d45d0969be2d43c302e2981826c58b658346a3ce7b26dc4a790186267002207f4dde817f197bbf5f5f54939d8fc2ed81325e82ab7515255a1a52966236ccf9:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/exposures/backups/sql-server-dump.yaml"

View on Github