LandGrey/SpringBootVulExploit
SpringBootVulExploit
SpringBootVulExploit es una colección de herramientas de escaneo y auditoría diseñadas para identificar vulnerabilidades, fugas de información y vectores de ejecución dentro de frameworks de aplicaciones basados en Java, específicamente dirigidas a aplicaciones Spring Boot. Proporciona una suite de técnicas de explotación, payloads y listas de verificación de seguridad para realizar análisis de vulnerabilidades.
El proyecto cuenta con capacidades para activar la ejecución remota de código a través de vectores de inyección, payloads de deserialización y archivos de configuración maliciosos. Incluye un escáner para detectar variables de entorno expuestas y detalles de enrutamiento interno causados por endpoints mal configurados, así como métodos para extraer datos sensibles y secretos en texto plano mediante el análisis de heap dumps.
El conjunto de herramientas soporta evaluaciones de seguridad de caja negra y análisis de vulnerabilidades de frameworks, incluyendo el mapeo de versiones de dependencias para identificar posibles ventanas de vulnerabilidad.
Features
- Spring Boot Security Testing - Offers a comprehensive suite of exploitation techniques and checklists specifically for testing Spring Boot applications.
- Information Leakage - Identifies hidden system details and sensitive information by targeting misconfigured routing paths and administrative interfaces.
- Java Security Research Frameworks - Provides a structured framework and checklist for performing security audits and dependency mapping on Java frameworks.
- Deserialization Payloads - Implements techniques to trigger remote execution by sending maliciously crafted serialized objects.
- Remote Code Execution Testing - Provides methods to trigger unauthorized code execution on a server via injection vectors or malicious configuration.
- Spring Boot Vulnerability Collections - Collects exploit techniques, payloads, and security checklists for identifying vulnerabilities in Spring Boot applications.
- Vulnerability Analysis - Analyzes framework dependency versions and probing points to identify security flaws and vulnerability windows.
- Injection Payloads - Provides a collection of crafted input strings designed to trigger unintended code execution via injection vulnerabilities.
- Vulnerability Window Mapping - Determines compatible version relationships between releases to identify potential security vulnerability windows.
- Sensitive Data Extraction - Extracts plaintext passwords and secrets by inspecting the raw memory state of a running Java virtual machine.
- Credential Leak Detection - Detects exposed routing information and environment variables that may leak sensitive credentials via misconfigured endpoints.
- Sensitive Data Extraction Tools - Retrieves plaintext passwords and secrets from system memory via heap dump analysis and request interception.
- Black Box Security Scanning - Provides structured checklists and probes for security assessments of applications without requiring source code access.
- Vulnerability Labs - Learning resources and exploits for Spring Boot vulnerabilities.
- Vulnerability Exploitation - Exploitation framework for Java microservice framework vulnerabilities.
