hunt-springboot

# HUNT-SPRINGBOOT — Spring Boot Specific Vulnerabilities ## Crown Jewel Targets Spring Boot Actuator `/actuator/heapdump` exposed = heap dump with all secrets in memory. **Highest-value findings:** - **`/actuator/heapdump`** — full JVM heap dump contains plaintext passwords, tokens, DB credentials, private keys stored anywhere in memory - **`/actuator/env`** — lists all environment variables and Spring properties including secrets - **`/actuator/shutdown`** — POST → shuts down the application (Critical availability impact) - **H2 Console (`/h2-console`)** — in-memory DB admin UI → SQL query execution → potential RCE via `CREATE ALIAS` trick - **SpEL injection** — Spring Expression Language in template fields, `@Value` annotations, SpEL-processed request params → RCE - **Spring4Shell CVE-2022-22965** — Spring Framework < 5.3.18 + Tomcat → RCE via data binding --- ## Phase 1 — Fingerprint Spring Boot ```bash # Spring Boot indicators curl -sI https://$TARGET/ | grep -i "x-application-context\|x-content-type" curl -s "https://$TARGET/nonexistent" | grep -i "Whitelabel Error Page\|Spring Boot\|org.springframework" # Actuator root (may list available endpoints) curl -s "https://$TARGET/actuator" | python3 -m json.tool 2>/dev/null curl -s "https://$TARGET/actuator/" | python3 -m json.tool 2>/dev/null # Try common base paths for base in "" "/manage" "/management" "/app"; do STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$base/actuator") [ "$STATUS" = "200...