> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/web/information-disclosure/source-code-disclosure-via-backup-files.md).

# Divulgation du code source via des fichiers de sauvegarde

### Divulgation du code source via des fichiers de sauvegarde

**Description du laboratoire**

Ce laboratoire expose le code source de l'application via **des fichiers de sauvegarde** stockés dans un répertoire caché. / L'objectif est d'identifier et de soumettre le **mot de passe de la base de données**, qui est codé en dur dans le code source divulgué.

**Étapes de l’opération**

**Découverte du contenu**/ En utilisant **Burp Suite** (fonction Découvrir le contenu ), nous analysons les chemins accessibles de l'application.

<figure><img src="/files/8b5dedbbac625c7d3ede9eb47190909c9b292aed" alt=""><figcaption></figcaption></figure>

**Identification d'un répertoire sensible**/ L'analyse révèle l'existence d'un répertoire caché nommé **backup**.

<figure><img src="/files/a31a777e0600c2eb68628f8f6eb0732990b0e9ea" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/2e1bc9ea77e3f289b3563515724546670e6a3d4d" alt=""><figcaption></figcaption></figure>

**Accès aux fichiers de sauvegarde**/ Dans ce répertoire, un fichier de sauvegarde avec une extension `.bk` est accessible. / Il contient du \*\*code Java\*\* expliqué.

<figure><img src="/files/0f27eead3aeae39bc79252af6f8f4524622cda3e" alt=""><figcaption></figcaption></figure>

**Analyse du code divulgué**/ Le fichier révèle des informations de connexion à une **PostgreSQL** base de données, avec des identifiants codés en dur.

<figure><img src="/files/6f78707d501bb8bb427139619f5e0ee4a94d3147" alt=""><figcaption></figcaption></figure>

```java
        ConnectionBuilder connectionBuilder = ConnectionBuilder.from(
                "org.postgresql.Driver",
                "postgresql",
                "localhost",
                5432,
                "postgres",
                "postgres",
                "eq77s9j4j4sa5a3m9iymzi9e2m8e68sj"
        ).withAutoCommit();
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/fr/web/information-disclosure/source-code-disclosure-via-backup-files.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.