Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • A arachni
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 125
    • Issues 125
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 8
    • Merge requests 8
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Arachni - Web Application Security Scanner Framework
  • arachni
  • Issues
  • #634
Closed
Open
Issue created Nov 08, 2015 by Administrator@rootContributor

False positive backup folders, not actually existing?

Created by: illtellyoulater

For every website I scan Arachni gives me many backup folders (and I think it spends the majority of time with those requests and their processing). They usually amount to one hundred or more, basically they are multiple of the "real" pages because for any of those there are many backup folders.

But if I try to open them the servers just say 404 not found.

Example, just for a index.php, I get these backup directories in report:

http://www.domain.com/index.php%20-%20Copy%20(2)/ http://www.domain.com/index.php%20-%20Copy/ http://www.domain.com/index.php%20(4th%20copy)/ http://www.domain.com/index.php%20(3rd%20copy)/ http://www.domain.com/index.php%20-%20Copy%20Copy/ http://www.domain.com/index.php%20(third%20copy)/ http://www.domain.com/index.php%20(another%20copy)/ http://www.domain.com/index.php%20(copy)/

Strangely enough I saw a similar issue with OWASP ZAP which constantly reports the presence of many backup folders which just don't exist.. (can't remember if they had same names right now...).

Assignee
Assign to
Time tracking