LandGrey/SpringBootVulExploit
SpringBootVulExploit
SpringBootVulExploit is a collection of scanning and auditing tools designed to identify vulnerabilities, information leaks, and execution vectors within Java-based application frameworks, specifically targeting Spring Boot applications. It provides a suite of exploit techniques, payloads, and security checklists for performing vulnerability analysis.
The project features capabilities for triggering remote code execution through injection vectors, deserialization payloads, and malicious configuration files. It includes a scanner for detecting exposed environment variables and internal routing details caused by misconfigured endpoints, as well as methods for extracting sensitive data and plaintext secrets via heap dump analysis.
The toolset supports black-box security assessments and framework vulnerability analysis, including the mapping of dependency versions to identify potential vulnerability windows.
Features
- Spring Boot Security Testing - Offers a comprehensive suite of exploitation techniques and checklists specifically for testing Spring Boot applications.
- Information Leakage - Identifies hidden system details and sensitive information by targeting misconfigured routing paths and administrative interfaces.
- Java Security Research Frameworks - Provides a structured framework and checklist for performing security audits and dependency mapping on Java frameworks.
- Deserialization Payloads - Implements techniques to trigger remote execution by sending maliciously crafted serialized objects.
- Remote Code Execution Testing - Provides methods to trigger unauthorized code execution on a server via injection vectors or malicious configuration.
- Spring Boot Vulnerability Collections - Collects exploit techniques, payloads, and security checklists for identifying vulnerabilities in Spring Boot applications.
- Vulnerability Analysis - Analyzes framework dependency versions and probing points to identify security flaws and vulnerability windows.
- Injection Payloads - Provides a collection of crafted input strings designed to trigger unintended code execution via injection vulnerabilities.
- Vulnerability Window Mapping - Determines compatible version relationships between releases to identify potential security vulnerability windows.
- Sensitive Data Extraction - Extracts plaintext passwords and secrets by inspecting the raw memory state of a running Java virtual machine.
- Credential Leak Detection - Detects exposed routing information and environment variables that may leak sensitive credentials via misconfigured endpoints.
- Sensitive Data Extraction Tools - Retrieves plaintext passwords and secrets from system memory via heap dump analysis and request interception.
- Black Box Security Scanning - Provides structured checklists and probes for security assessments of applications without requiring source code access.
- Vulnerability Labs - Learning resources and exploits for Spring Boot vulnerabilities.
- Vulnerability Exploitation - Exploitation framework for Java microservice framework vulnerabilities.
