# Hunt Springboot

Hunt Spring Boot specific vulnerabilities, Actuator endpoints (heapdump, env, loggers...

- Repository: https://github.com/Zyrexnn/Cybermes (987 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Zyrexnn/Cybermes --skill hunt-springboot -g -a claude-code -y`
Codex: `npx skills add Zyrexnn/Cybermes --skill hunt-springboot -g -a codex -y`
Cursor: `npx skills add Zyrexnn/Cybermes --skill hunt-springboot -g -a cursor -y`
Gemini CLI: `npx skills add Zyrexnn/Cybermes --skill hunt-springboot -g -a gemini-cli -y`

## Description

Hunt Spring Boot specific vulnerabilities, Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SPEL (CVE-2022-22963), heap dump credential extraction. Use when target runs Spring Boot, detected via X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# HUNT-SPRINGBOOT, Spring Boot Specific Vulnerabilities

## Crown Jewel Targets

Spring Boot Actuator `/actuator/heapdump` exposed = heap dump with all secrets in memory.

**Highest-value findings:**
- **`/actuator/heapdump`**, full JVM heap dump contains plaintext passwords, tokens, DB credentials, private keys stored anywhere in memory
- **`/actuator/env`**, lists all environment variables and Spring properties including secrets
- **`/actuator/shutdown`**, POST → shuts down the application (Critical availability impact)
- **H2 Console (`/h2-console`)**, in-memory DB admin UI → SQL query execution → potential RCE via `CREATE ALIAS` trick
- **SpEL injection**, Spring Expression Language in template fields, `@Value` annotations, SpEL-processed request params → RCE
- **Spring4Shell CVE-2022-22965**, Spring Framework < 5.3.18 + Tomcat → RCE via data binding

---

## Phase 1, Fingerprint Spring Boot

```bash
# Spring Boot indicators
curl -sI https://$TARGET/ | grep -i "x-application-context\|x-content-type"
curl -s "https://$TARGET/nonexistent" | grep -i "Whitelabel Error Page\|Spring Boot\|org.springframework"

# Actuator root (may list available endpoints)
curl -s "https://$TARGET/actuator" | python3 -m json.tool 2>/dev/null
curl -s "https://$TARGET/actuator/" | python3 -m json.tool 2>/dev/null

# Try common base paths
for base in "" "/manage" "/management" "/app"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$base/actuator")
  [ "$STATUS" = "200" ] && echo "[+] Actuator at: $TARGET$base/actuator"
done
```

---

## Phase 2, Actuator Endpoint Enumeration

```bash
BASE="https://$TARGET/actuator"

# High-impact endpoints
ENDPOINTS=("env" "heapdump" "threaddump" "mappings" "beans" "metrics" 
           "loggers" "info" "health" "configprops" "shutdown" "trace"
           "httptrace" "auditevents" "sessions" "scheduledtasks" "caches"
           "flyway" "liquibase" "refresh" "restart")

The rest: https://github.com/Zyrexnn/Cybermes/blob/HEAD/knowledge/Claude-BugHunter/skills/hunt-springboot/SKILL.md