Hunt Springboot
Hunt Spring Boot specific vulnerabilities, Actuator endpoints (heapdump, env, loggers...
Install
npx skills add Zyrexnn/Cybermes --skill hunt-springboot -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Security
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,174 tokens
- Runs scripts
- No, instructions only
What it does
Hunt Spring Boot specific vulnerabilities, Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SPEL (CVE-2022-22963), heap dump credential extraction. Use when target runs Spring Boot, detected via X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.
HUNT-SPRINGBOOT, Spring Boot Specific Vulnerabilities
Crown Jewel Targets
Spring Boot Actuator /actuator/heapdump exposed = heap dump with all secrets in memory.
Highest-value findings:
/actuator/heapdump, full JVM heap dump contains plaintext passwords, tokens, DB credentials, private keys stored anywhere in memory/actuator/env, lists all environment variables and Spring properties including secrets/actuator/shutdown, POST → shuts down the application (Critical availability impact)- H2 Console (
/h2-console), in-memory DB admin UI → SQL query execution → potential RCE viaCREATE ALIAStrick - SpEL injection, Spring Expression Language in template fields,
@Valueannotations, SpEL-processed request params → RCE - Spring4Shell CVE-2022-22965, Spring Framework < 5.3.18 + Tomcat → RCE via data binding
Phase 1, Fingerprint Spring Boot
# Spring Boot indicators
curl -sI https://$TARGET/ | grep -i "x-application-context\|x-content-type"
curl -s "https://$TARGET/nonexistent" | grep -i "Whitelabel Error Page\|Spring Boot\|org.springframework"
# Actuator root (may list available endpoints)
curl -s "https://$TARGET/actuator" | python3 -m json.tool 2>/dev/null
curl -s "https://$TARGET/actuator/" | python3 -m json.tool 2>/dev/null
# Try common base paths
for base in "" "/manage" "/management" "/app"; do
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$base/actuator")
[ "$STATUS" = "200" ] && echo "[+] Actuator at: $TARGET$base/actuator"
done
Phase 2, Actuator Endpoint Enumeration
BASE="https://$TARGET/actuator"
# High-impact endpoints
ENDPOINTS=("env" "heapdump" "threaddump" "mappings" "beans" "metrics"
"loggers" "info" "health" "configprops" "shutdown" "trace"
"httptrace" "auditevents" "sessions" "scheduledtasks" "caches"
"flyway" "liquibase" "refresh" "restart")
