Investigating a Website Backup Leak is a hands-on web security course for beginners. Step into the role of Northstar's on-call engineer, trace an unusual download in Nginx access logs, and protect an internal archive without interrupting the support website.
The course combines one Guided Lab and one Challenge. The Guided Lab takes you from investigation to repair in three focused steps. The Challenge gives you a second portal with a different layout and filenames, so you can apply the same methods independently.
What You Will Learn
After completing this course, you will be able to:
- read the key fields in a web access log and identify a successful file download;
- use
curlandtarto inspect what a website actually exposes; - connect a request URL to the server's public directory, or web root;
- preserve internal data outside that public directory;
- test that a private download is blocked while public pages and approved downloads still work.
Who This Course Is For
This course is for security beginners, developers, and aspiring system administrators who want to investigate and repair a concrete website exposure.
Prerequisites: Basic terminal familiarity, including entering commands and recognizing file paths. No Nginx administration, penetration-testing, or programming experience is required. The course introduces the HTTP, log, and archive concepts used in the tasks.
Learning environment: A preconfigured browser-based Linux environment with Workstation and Web Server terminals and a Topology view. The website, sample records, and request history are provided; no local installation is needed.
Frequently Asked Questions
Do I need to set up a web server?
No. The website and both terminals are ready when the lab starts. You can focus on the investigation and repair.
Will I need to write application code?
No. You will use terminal tools to inspect requests, read configuration, move a file, and test the result.
How does the Challenge build on the Guided Lab?
It uses the same tools and repair method with a different site layout and archive name. You decide which download is internal and apply the repair without a walkthrough. A complete explanatory solution is available if you get stuck.
