While I was playing some Capture the Flag (CTF), I couldn't solve a challenge because of this tilde ~. I'm playing on www.example.com/index.php but when I added (~) at the end: www.example.com/index.php~ , a file with name index.php started downloading.
Could you explain to me what's the role of this tilde (~)?
It's just part of the filename, just like letters, numbers, and other special characters can be part of the filename.
It's conventional to create "backups" of files before editing them by appending a tilde, so in case you mess something up, you have a previous version to restore. In Bash this can be easily done with cp index.php{,~} which expands to cp index.php index.php~.
It could be on the CTF because people often forget about those files and leave them unprotected. Especially a file like index.php might contain database credentials.
In bash, a tilde at the start of an argument also expands to a home folder: ~ turns into $HOME (e.g. /home/yourusername), or ~username turns into that user's home folder (e.g. ~root typically expands to /root). That is not the case here, though, because it's not at the beginning.
~ is a common suffix added to filenames for backup or temporary copies of files. This may be a manual backup or one created by an editor or other tool.
Although most file systems don't have a concept of "file extensions", a lot of software uses the part of a filename after the first or last . to determine the file type and what to do with it.
In this case, the web server will have been configured to execute files ending in .php, but to serve the contents of other file types. Since .php~ appears to be a different "file extension", it doesn't match the rule to be executed, and you are served the source code. This in turn allows you to see the likely contents of the PHP script which should have been executed (i.e. it is likely that index.php~ has similar contents to index.php), which may reveal credentials or clues to other exploits.
There are two things the hypothetical sysadmin should have done to avoid this:
You've discovered a potential security flaw for web apps.
The scenario is this:
.php files).~) on the end. A tilde often means "this is system-generated, don't worry about it".Whether this is of much use is variable. Sometimes source code may contain things like authentication details for databases or external services.
I'm playing on
www.example.com/index.phpbut when I added (~) at the end:www.example.com/index.php~, a file with nameindex.phpstarted downloading.
As others have mentioned, many text editors (most notably Emacs, I'd say) back up earlier versions of files you work on by creating another file whose name is the same as the original but with a tilde appended.
What other answers haven't stressed enough, however, is that the fact that you can access such a file is a consequence of some mix of incorrect version control or incorrect build and deployment.
Version control systems (VCS) have mechanisms to configure a repository so that the VCS filenames that match specified patterns will be ignored. The most popular version control system today is Git, and its mechanism for this is special files named .gitignore. Most source code Git repositories ought to have a top level .gitignore file that has this line in it:
*~
That's a pattern telling Git to ignore all files whose name ends with a tilde. A common mistake among developers is to not maintain these files diligently, or just completely ignore them. For example, many IDEs will pop up a warning when they find untracked files in your source tree and give you the option of telling the IDE to ignore them. You should almost never use that option; instead, figure out what to put in the repo's "ignore" file so that everybody who checks it out automatically gets set up to never check these files in.
Disciplined use of such "ignore" files goes a very long way to protecting you from many other security problems. For example they can help protect you against the common problem of developers accidentally checking in secret credentials. One practice I've found useful is to adopt a standard layout where you projects have a designated directory for developers to place such files. You can then set up your VCS repository so files in that directory are ignored, and design your application so that development builds will get their configuration from there.
The other thing that is likely to cause problems like that is build and deployment processes that incorrectly propagate files like the index.php~ in question.
Some practices that should be adopted to avoid this:
Another important tip is to use battle-tested build tools to build your projects, that enforce a rational project layout and have some good story on how to identify which files should be packaged and which not. The build tools for many languages, for example, instead of just blindly archiving everything in your source repository, will selectively copy files from it into a temporary staging directory, and then archive that, so that only files that the tool explicitly selected for inclusion get included.
make clean.example.com/index.php~could be a server without PHP sending content from a string, a database, etc., with a HTTP header telling the browser a filename. The fact that the downloaded file doesn't have the ~ on the end (unless that's your typo?) suggests this is more likely the case. (i.e. this is not a ~ at the end of a file extension, it's a ~ at the end of a URI).