Add Finding for zip extension in URL_HINT

bbot/modules/iis_shortnames.py

@@ -166,6 +166,10 @@ async def solve_shortname_recursive(
 
         cl = ext_char_list if extension_mode is True else char_list
 
+        self.debug(
+            f"Solving shortname recursive for {target} with prefix {prefix} and extension mode {extension_mode}"
+        )
+
         urls_and_kwargs = []
 
         for c in cl:
@@ -334,6 +338,18 @@ class safety_counter_obj:
                     for url_hint in url_hint_list:
                         if "." in url_hint:
                             hint_type = "shortname-endpoint"
+                            # Check if it's a ZIP file
+                            if url_hint.lower().endswith(".zip"):
+                                await self.emit_event(
+                                    {
+                                        "host": str(event.host),
+                                        "url": event.data,
+                                        "description": f"Possible backup file (zip) in web root: {normalized_url}{url_hint}",
+                                    },
+                                    "FINDING",
+                                    event,
+                                    context=f"{{module}} discovered possible backup file in web root: {url_hint}",
+                                )
                         else:
                             hint_type = "shortname-directory"
 

bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py

@@ -43,19 +43,64 @@ async def setup_after_prep(self, module_test):
         respond_args = {"response_data": "", "status": 400}
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
-        for char in "BLSHAX":
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BA\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BAC\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACK\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKU\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP\*~1\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\.Z\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\.ZI\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\.ZIP\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        for char in "BLSHAXCKUP":
             expect_args = {"method": "GET", "uri": re.compile(rf"\/\*{char}\*~1\*.*$")}
             respond_args = {"response_data": "", "status": 400}
             module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
+        for char in "ZIP":
+            expect_args = {"method": "GET", "uri": re.compile(rf"\/\*~1\*{char}\*.*$")}
+            respond_args = {"response_data": "", "status": 400}
+            module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
     def check(self, module_test, events):
         vulnerabilityEmitted = False
         url_hintEmitted = False
+        zip_findingEmitted = False
         for e in events:
             if e.type == "VULNERABILITY" and "iis-magic-url" not in e.tags:
                 vulnerabilityEmitted = True
             if e.type == "URL_HINT" and e.data == "http://127.0.0.1:8888/BLSHAX~1":
                 url_hintEmitted = True
+            if e.type == "FINDING" and "Possible backup file (zip) in web root" in e.data["description"]:
+                zip_findingEmitted = True
 
         assert vulnerabilityEmitted
         assert url_hintEmitted
+        assert zip_findingEmitted