Post cover image
Figure 2: Viewing the open directory listing on the /backup endpoint containing a Java source backup file.

August 25, 2026

Lab Write-up: Source Code Disclosure via Backup Files

Objective

By Ayeshaaghafoor

1 min read

Objective

The objective of this lab is to find a hidden backup directory via reconnaissance, analyze a leaked Java source file backup, extract a hard-coded database password, and submit it to solve the lab.

Step-by-Step Exploitation

Step 1: Discover the Hidden Directory

  1. Access the home page of the lab.
  2. In your browser's address bar, append /robots.txt to the lab's main domain to check for any directories explicitly hidden from search engine crawlers.
  3. Observe the robots.txt rule: Disallow: /backup. This leaks the existence of an unindexed /backup directory.
None

Step 2: Access the Backup Index

  1. Change the URL endpoint in your browser to navigate directly to the /backup directory.
  2. Because directory browsing is improperly configured, the server displays an open index page showing a backup file named ProductTemplate.java.bak.
None

Step 3: Extract the Database Password

  1. Click on the link for ProductTemplate.java.bak or navigate directly to /backup/ProductTemplate.java.bak to read its contents.
  2. Review the Java source code structure. Within the database connection block (ConnectionBuilder.from(...)), locate the hard-coded parameters for the PostgreSQL driver connection.
  3. Identify and copy the long string parameter value representing the database password (e.g., nyrg4gmcxnz9wwhd4a6dfvkflun5c3zx).
None

Step 4: Submit Solution

  1. Copy the extracted password string.
  2. Return to the main lab interface banner, click Submit solution, paste the password text, and click OK to solve the lab.

Remediation

Leaving source code or backup artifacts in a web-accessible directory allows attackers to reconstruct database logic and steal secrets. Fix this vulnerability with the following controls:

  • Remove Non-Production Files: Never store editor backup files (*.bak, *.swp), old versions, or raw source text code inside the public web document root (public_html, www).
  • Disable Directory Browsing: Configure the web server (Apache, Nginx, IIS) to disable directory listings globally so users cannot view structural file lists if an index file is absent.
  • Externalize Sensitive Credentials: Avoid hard-coding application secrets or infrastructure passwords into code files. Use environmental variables or a dedicated key-management system instead.