The Backup File in the Web Root
While reviewing a web application you discover that https://app.example.test/backup/ returns a directory listing containing app-2024-03-01.zip and db.sql.gz. You download them (authorised) and find the zip contains source code with a hard-coded database password in config.php, and db.sql.gz contains a full dump including password hashes and customer PII. The application is internet-facing. The client's developer says 'that folder isn't linked from anywhere, so nobody would find it.' You have 90 minutes left and the client wants to know 'how bad is this, really?'
1. How do you rate and prioritise this, and what is the immediate containment advice?
Read the worked answer
This is critical and should be escalated immediately, ahead of the rest of the report.
Why:
- Internet-facing, unauthenticated access to a full database dump containing PII and password hashes - that is a data breach exposure, not just a config issue.
- Hard-coded DB credentials in source give direct database access if the DB is reachable.
- 'Not linked' is not a control: directory listing is enabled, and backup filenames are guessable/dated. Automated crawlers and attackers enumerate common paths (
/backup/,/db/,.zip,.sql.gz) constantly.
Immediate containment advice (verbal + written now):
- Remove/relocate the backup directory from the web root and disable directory listing.
- Rotate the database password and any other secrets in the code.
- Treat the PII exposure as a potential breach: preserve logs, determine exposure window and whether the files were accessed by others, and involve the client's DPO/legal per their obligations.
Do not wait for the final report to communicate a live data exposure.
2. The developer argues it's low risk because the folder is unlinked. How do you counter this in the report without being adversarial?
Read the worked answer
Use evidence and framing, not argument:
- Evidence: state plainly that you found it via directory enumeration, that listing was enabled, and that the filenames follow a predictable dated pattern. 'Unlinked' describes discoverability by a human clicking links, not by a scanner - and scanners are the threat model for an internet-facing host.
- Framing: separate the technical fact (files are retrievable without authentication) from the likelihood debate. Even if likelihood were low, impact (PII + hashes + DB creds) is severe, so the risk rating stays high.
- Constructive tone: acknowledge the developer's point that it wasn't advertised, then show why it doesn't reduce the rating, and give the concrete fix.
The exam tests whether you can hold a correct severity position while keeping the client engaged - evidence over assertion.