Add ':' for split of PATH in backup_file.rb

[nrathaus]

At the moment backup_file.rb support single path lookup, by adding the ability to use : delimiter you can now use the module with multiple paths at one 'run'

Step to recreate (the web server target I use, returns 200 OK on everything):

use scanner/http/backup_file
set PATH "/index.asp:/something.asp:/other.asp"
set RHOSTS 10.0.0.243

[+] Found http://10.0.0.243:80/index.asp.backup
[+] Found http://10.0.0.243:80/index.asp.bak
[+] Found http://10.0.0.243:80/index.asp.copy
[+] Found http://10.0.0.243:80/index.asp.copia
[+] Found http://10.0.0.243:80/index.asp.old
[+] Found http://10.0.0.243:80/index.asp.orig
[+] Found http://10.0.0.243:80/index.asp.temp
[+] Found http://10.0.0.243:80/index.asp.txt
[+] Found http://10.0.0.243:80/index.asp~
[+] Found http://10.0.0.243:80/.index.asp.swp
[+] Found http://10.0.0.243:80/something.asp.backup
[+] Found http://10.0.0.243:80/something.asp.bak
[+] Found http://10.0.0.243:80/something.asp.copy
[+] Found http://10.0.0.243:80/something.asp.copia
[+] Found http://10.0.0.243:80/something.asp.old
[+] Found http://10.0.0.243:80/something.asp.orig
[+] Found http://10.0.0.243:80/something.asp.temp
[+] Found http://10.0.0.243:80/something.asp.txt
[+] Found http://10.0.0.243:80/something.asp~
[+] Found http://10.0.0.243:80/.something.asp.swp
[+] Found http://10.0.0.243:80/other.asp.backup
[+] Found http://10.0.0.243:80/other.asp.bak
[+] Found http://10.0.0.243:80/other.asp.copy
[+] Found http://10.0.0.243:80/other.asp.copia
[+] Found http://10.0.0.243:80/other.asp.old
[+] Found http://10.0.0.243:80/other.asp.orig
[+] Found http://10.0.0.243:80/other.asp.temp
[+] Found http://10.0.0.243:80/other.asp.txt
[+] Found http://10.0.0.243:80/other.asp~
[+] Found http://10.0.0.243:80/.other.asp.swp
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

[adfoster-r7]

I don't have the full context on this module; Does this module need to work with full paths for windows envs? If so I don't think this will work for this scenario: C:\\inetpub\\wwwroot\\foo.asp

Potentially PATH is just a misnomer though, and this is really FILE_LIST or something

[nrathaus]

The module does HTTP requests to a server trying to find 'backup' files (by adding an extension of .backup for example)

I do not believe : is a valid HTTP (URI part)

[adfoster-r7]

Ah; gotcha. I believe the normal pattern is to take such wordlists from a file

So this would become OptPath and it would point towards a default wordlist that ships with metasploit, but the user can override it to point to their own wordlist

Like this - I'd probably use this pattern for the file reading:

metasploit-framework/modules/auxiliary/scanner/http/log4shell_scanner.rb

Lines 59 to 66 in e6fb178

	OptPath.new(
	'URIS_FILE',
	[
	false,
	'File containing additional URIs to check',
	File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-44228', 'http_uris.txt')
	]
	),

Another example, but the file reading implementation isn't as good as the above:

metasploit-framework/modules/auxiliary/scanner/http/ntlm_info_enumeration.rb

Lines 29 to 32 in e6fb178

	OptPath.new('TARGET_URIS_FILE', [
	false, 'Path to list of URIs to request',
	File.join(Msf::Config.data_directory, 'wordlists', 'http_owa_common.txt')
	]),

[nrathaus]

I see

We can migrate to the one TARGET_URIS_FILE as it more suitable - though none of those paths are relevant for backup files..

For best outcome we should use dirb (a tool used to bruteforce files and directories) common.txt file:
https://salsa.debian.org/pkg-security-team/dirb/-/blob/debian/master/wordlists/common.txt