Create With AI – Finding Exposed Database Backups on Public Assets

Enterprise-grade Automation with Pentester-level Flexibility

This library showcases real examples of how security teams use Create with AI to save time, reduce manual effort, and strengthen their defenses.

Unlike traditional scanners that limit users to predefined checks, Create with AI gives complete flexibility. You describe what you need, and the AI builds and runs it instantly. This allows teams to automate the exact tests they want instead of being restricted to what the product designer imagined.

Finding Exposed Database Backups on Public Assets

Problem

Old or forgotten backups left in publicly accessible locations can expose entire databases to anyone who knows where to look. Attackers frequently scan for files named backup.zip or similar, since these often contain database dumps with .sql files, API credentials, or customer information. Manually checking for these across large inventories is time-consuming and easy to miss.

Instant Solution (Create with AI)

Prompt: Create a scan that checks for the presence of a backup.zip file across all assets. If the file exists, open it and inspect its contents. If any file ending with .sql is found, raise an alarm; otherwise, show “No SQL files found.”

With a single command, the AI-generated scan looks for a backup.zip file on every asset, downloads it safely, and inspects the filenames inside the archive. If it finds any .sql files, it instantly flags the asset as a critical risk, helping teams prevent data exposure before attackers discover it.

🎥 Watch the Scan in Action

Value

• Detects exposed backup archives that could leak entire databases
  
• Automates what would take hours of manual file checks
  
• Provides clear, immediate evidence of potential data exposure
  
• Can be easily customized to detect other file types such as .env, .bak, or .log
  

Demonstrates the flexibility of Create with AI in adapting to new scanning logic in seconds

Closing Takeaway

This scenario illustrates how Create with AI helps security teams discover forgotten or misconfigured assets that traditional scanners often overlook. By turning a simple idea into a scalable, automated check, teams can quickly identify sensitive archives and prevent costly data leaks. The same method can be adapted to search for any pattern of interest across large environments simply by changing the prompt.

🧰 Check It Yourself

Check the sample scan code below or watch the video for a live walkthrough.

class Job(Task):
    def run(self):
        asset = http_or_https(asset=self.asset, _headers=self.headers, session=self.session)
        self.output['detail'] = []
        self.output['compact'] = []
        self.output['video'] = [f"python3 backup-check.py {asset}"]
        
        try:
            url = f"{asset.rstrip('/')}/backup.zip"
            response = requests.get(url, headers=self.headers, allow_redirects=False, verify=False, timeout=10)
            
            if response.status_code == 200:
                with zipfile.ZipFile(BytesIO(response.content)) as z:
                    sql_files = [f for f in z.namelist() if f.endswith('.sql')]
                    if sql_files:
                        self.output['compact'].append("SQL files found in backup.zip: {}".format(', '.join(sql_files)))
                        self.output['detail'].append("Identified SQL files: {}".format(', '.join(sql_files)))
                        self.output['video'].append("Identified SQL files: {}".format(', '.join(sql_files)))
                    else:
                        self.output['detail'].append("No SQL files found in backup.zip.")
                        self.output['video'].append("No SQL files found in backup.zip.")
            else:
                self.output['detail'].append("backup.zip not found")
                self.output['video'].append("backup.zip not found")
        except:
            self.output['detail'].append("backup.zip not found")
            self.output['video'].append("backup.zip not found")

    def calculate_score(self):
        if self.output['compact']:
            self.score = self.param['max_score']
        else:
            self.score = 0

class Job(Task):
    def run(self):
        asset = http_or_https(asset=self.asset, _headers=self.headers, session=self.session)
        self.output['detail'] = []
        self.output['compact'] = []
        self.output['video'] = [f"python3 backup-check.py {asset}"]
        
        try:
            url = f"{asset.rstrip('/')}/backup.zip"
            response = requests.get(url, headers=self.headers, allow_redirects=False, verify=False, timeout=10)
            
            if response.status_code == 200:
                with zipfile.ZipFile(BytesIO(response.content)) as z:
                    sql_files = [f for f in z.namelist() if f.endswith('.sql')]
                    if sql_files:
                        self.output['compact'].append("SQL files found in backup.zip: {}".format(', '.join(sql_files)))
                        self.output['detail'].append("Identified SQL files: {}".format(', '.join(sql_files)))
                        self.output['video'].append("Identified SQL files: {}".format(', '.join(sql_files)))
                    else:
                        self.output['detail'].append("No SQL files found in backup.zip.")
                        self.output['video'].append("No SQL files found in backup.zip.")
            else:
                self.output['detail'].append("backup.zip not found")
                self.output['video'].append("backup.zip not found")
        except:
            self.output['detail'].append("backup.zip not found")
            self.output['video'].append("backup.zip not found")

    def calculate_score(self):
        if self.output['compact']:
            self.score = self.param['max_score']
        else:
            self.score = 0