Lab: Source code disclosure via backup files
Summary: PortSwigger's Web Security Academy lab demonstrates source code disclosure through backup files: the site's /robots.txt reveals a /backup directory containing ProductTemplate.java.bak, and the leaked source code holds a hard-coded Postgres database password. The lab is solved by browsing to /backup/ProductTemplate.java.bak, reading the connection builder in the source, and submitting the password.
Bottom line: A robots.txt entry pointing at a backup directory was enough to expose source code and a hard-coded database credential, so any .bak file left in a web-reachable path is a direct path to your database.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026