| This check is limited to CGI/interactive content and not static HTML. |
Search for backup copies of CGI scripts on the web server or ask the SA or the Web Administrator if they keep backup copies of CGI scripts on the web server.
Common backup file extensions are: *.bak, *.old, *.temp, *.tmp, *.backup, *.??0. This would also apply to .jsp files.
find / -name “*.bak” –print
find / -name “*.*~” –print
find / -name “*.old” –print
If files with these extensions are found in either the document directory or the home directory of the web server, this is a finding.
If files with these extensions are stored in a repository (not in the document root) as backups for the web server, this is a finding.
If files with these extensions have no relationship with web activity, such as a backup batch file for operating system utility, and they are not accessible by the web application, this is not a finding.