HackBlue

Labs / Web config review

Database backups with a directory listing

An nginx location serves the backup folder with autoindex on. Read the config, browse it as a visitor would with curl, and use the access log to see who downloaded what.

  • Terminal mission
  • Beginner
  • 3 objectives
  • 0 of 3 solved

Briefing

A cron job writes nightly database dumps to /srv/backups/shop. A developer exposed the folder over HTTPS “for a day” so a contractor could fetch one dump.

autoindex on makes nginx print a clickable list of every file in the directory. The access log records every request with status and bytes sent.

analyst@web-01

web-01 · Web config review

Type help for the command list and objectives for your tasks. Everything runs in this browser.

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.