Although files, such as domain directories, temporary files, or old backup/configuration files, are not referenced within the web application penetration testing.