---
description: >-
  https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-via-backup-files
---

# Source code disclosure via backup files

## Description

This lab leaks its source code via backup files in a hidden directory. To solve the lab, identify and submit the database password, which is hard-coded in the leaked source code.

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FT4hPuoRkmxp9mTQ8J9lg%2Fimage.png?alt=media&#x26;token=c8ba75b6-29ec-4804-97a9-8ac44d532c44" alt=""><figcaption></figcaption></figure>

Checking source code page (CTRL+U) and discovering others pages there're not of interesting, so the idea is to try to guess a potential backup page (eg. git, backup).

In this case i was lucky, because the correct directory path was backup: [https://0a5400e703e5812285d9c2ef009700ba.web-security-academy.net/backup](https://0a5400e703e5812285d9c2ef009700ba.web-security-academy.net/backup)

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fn6r6XlAcBWKeDBlrxpro%2Fimage.png?alt=media&#x26;token=4d909058-b947-4ca0-9b2b-384120c3c0bd" alt=""><figcaption></figcaption></figure>

with the relative file .bak called: ProductTemplate.java.bak that contain a java package with relative DB information and the password/answer that we need to solve the lab.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FQXFAGQEv5sKyHlmCGjbO%2Fimage.png?alt=media&#x26;token=d73f28e0-c64f-4ac2-8216-a60baa4e46f6" alt=""><figcaption><p><a href="https://0a5400e703e5812285d9c2ef009700ba.web-security-academy.net/backup/ProductTemplate.java.bak">https://0a5400e703e5812285d9c2ef009700ba.web-security-academy.net/backup/ProductTemplate.java.bak</a></p></figcaption></figure>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FRAhpSbpC69fr5Zkq3jEP%2Fimage.png?alt=media&#x26;token=6550b9fd-c727-49d9-b4c9-3fe071491c15" alt=""><figcaption></figcaption></figure>
