SpringBootVulExploit

SpringBootVulExploit este o colecție de instrumente de scanare și audit concepute pentru a identifica vulnerabilități, scurgeri de informații și vectori de execuție în cadrul framework-urilor de aplicații Java, vizând în mod specific aplicațiile Spring Boot. Oferă o suită de tehnici de exploatare, payload-uri și liste de verificare de securitate pentru efectuarea analizei de vulnerabilități.

Proiectul oferă capabilități pentru declanșarea execuției de cod la distanță (RCE) prin vectori de injecție, payload-uri de deserializare și fișiere de configurare malițioase. Include un scanner pentru detectarea variabilelor de mediu expuse și a detaliilor de rutare internă cauzate de endpoint-uri configurate greșit, precum și metode pentru extragerea datelor sensibile și a secretelor în text clar prin analiza heap dump-urilor.

Setul de instrumente suportă evaluări de securitate de tip black-box și analiza vulnerabilităților framework-ului, inclusiv maparea versiunilor de dependențe pentru a identifica ferestrele potențiale de vulnerabilitate.

Features

Spring Boot Security Testing - Offers a comprehensive suite of exploitation techniques and checklists specifically for testing Spring Boot applications.
Information Leakage - Identifies hidden system details and sensitive information by targeting misconfigured routing paths and administrative interfaces.
Java Security Research Frameworks - Provides a structured framework and checklist for performing security audits and dependency mapping on Java frameworks.
Deserialization Payloads - Implements techniques to trigger remote execution by sending maliciously crafted serialized objects.
Remote Code Execution Testing - Provides methods to trigger unauthorized code execution on a server via injection vectors or malicious configuration.
Spring Boot Vulnerability Collections - Collects exploit techniques, payloads, and security checklists for identifying vulnerabilities in Spring Boot applications.
Vulnerability Analysis - Analyzes framework dependency versions and probing points to identify security flaws and vulnerability windows.
Injection Payloads - Provides a collection of crafted input strings designed to trigger unintended code execution via injection vulnerabilities.
Vulnerability Window Mapping - Determines compatible version relationships between releases to identify potential security vulnerability windows.
Sensitive Data Extraction - Extracts plaintext passwords and secrets by inspecting the raw memory state of a running Java virtual machine.
Credential Leak Detection - Detects exposed routing information and environment variables that may leak sensitive credentials via misconfigured endpoints.
Sensitive Data Extraction Tools - Retrieves plaintext passwords and secrets from system memory via heap dump analysis and request interception.
Black Box Security Scanning - Provides structured checklists and probes for security assessments of applications without requiring source code access.
Vulnerability Labs - Learning resources and exploits for Spring Boot vulnerabilities.
Vulnerability Exploitation - Exploitation framework for Java microservice framework vulnerabilities.

Istoric stele

LandGreySpringBootVulExploit

Name: landgrey/springbootvulexploit
Author: LandGrey

View on GitHub

6,136 stele1,318 fork-uriJava1 vizualizare

SpringBootVulExploit

Features

Spring Boot Security Testing - Offers a comprehensive suite of exploitation techniques and checklists specifically for testing Spring Boot applications.
Information Leakage - Identifies hidden system details and sensitive information by targeting misconfigured routing paths and administrative interfaces.
Java Security Research Frameworks - Provides a structured framework and checklist for performing security audits and dependency mapping on Java frameworks.
Deserialization Payloads - Implements techniques to trigger remote execution by sending maliciously crafted serialized objects.
Remote Code Execution Testing - Provides methods to trigger unauthorized code execution on a server via injection vectors or malicious configuration.
Spring Boot Vulnerability Collections - Collects exploit techniques, payloads, and security checklists for identifying vulnerabilities in Spring Boot applications.
Vulnerability Analysis - Analyzes framework dependency versions and probing points to identify security flaws and vulnerability windows.
Injection Payloads - Provides a collection of crafted input strings designed to trigger unintended code execution via injection vulnerabilities.
Vulnerability Window Mapping - Determines compatible version relationships between releases to identify potential security vulnerability windows.
Sensitive Data Extraction - Extracts plaintext passwords and secrets by inspecting the raw memory state of a running Java virtual machine.
Credential Leak Detection - Detects exposed routing information and environment variables that may leak sensitive credentials via misconfigured endpoints.
Sensitive Data Extraction Tools - Retrieves plaintext passwords and secrets from system memory via heap dump analysis and request interception.
Black Box Security Scanning - Provides structured checklists and probes for security assessments of applications without requiring source code access.
Vulnerability Labs - Learning resources and exploits for Spring Boot vulnerabilities.
Vulnerability Exploitation - Exploitation framework for Java microservice framework vulnerabilities.

Alternative open-source pentru SpringBootVulExploit

Proiecte open-source similare, clasificate după numărul de funcționalități comune cu SpringBootVulExploit.

mbechler/marshalsec
mbechler/marshalsec
3,691Vezi pe GitHub
Marshalsec is a toolkit designed for generating malicious serialized Java objects to achieve remote code execution during the unmarshalling process. It functions as a Java deserialization exploit tool and a framework for triggering Java Naming and Directory Interface lookups to remote servers. The project provides a JNDI redirector service that intercepts lookups and points targets toward a remote codebase. It includes utilities for crafting payloads that force Java applications to download and execute arbitrary classes from a remote URL. The toolset covers security analysis activities inclu
Java
Vezi pe GitHub3,691
voorivex/pentest-guide
Voorivex/pentest-guide
2,761Vezi pe GitHub
This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part
bugbountybypassowasp-tests
Vezi pe GitHub2,761
pwntester/ysoserial.net
pwntester/ysoserial.net
3,735Vezi pe GitHub
ysoserial.net is a payload generator for .NET deserialization, designed to create malicious serialized objects and structured gadget chains. It serves as a tool for generating command execution strings and security testing suites used to assess vulnerabilities in .NET formatters. The tool enables the creation of sequences of object calls that trigger remote code execution during the reconstruction of serialized data. It produces specialized payloads for executing system commands, loading remote libraries, and accessing local file systems. The project includes capabilities for optimizing payl
C#
Vezi pe GitHub3,735
0x727/shuize_0x727
0x727/ShuiZe_0x727
4,014Vezi pe GitHub
ShuiZe_0x727 is an open-source intelligence gathering framework and attack surface management tool. It functions as an asset discovery engine and cyber intelligence aggregator designed to identify internet-facing assets, map network infrastructure, and visualize total network exposure. The project integrates vulnerability scanning and sensitive data leak detection to identify security weaknesses and unauthorized access points. It employs a combination of network space API queries, certificate log analysis, and public repository scanning to extract leaked credentials, API keys, and internal ad
Python
Vezi pe GitHub4,014

Vezi toate cele 30 alternative pentru SpringBootVulExploit

Întrebări frecvente

Ce face landgrey/springbootvulexploit?

Care sunt principalele funcționalități ale landgrey/springbootvulexploit?

Principalele funcționalități ale landgrey/springbootvulexploit sunt: Spring Boot Security Testing, Information Leakage, Java Security Research Frameworks, Deserialization Payloads, Remote Code Execution Testing, Spring Boot Vulnerability Collections, Vulnerability Analysis, Injection Payloads.

Care sunt câteva alternative open-source pentru landgrey/springbootvulexploit?

Alternativele open-source pentru landgrey/springbootvulexploit includ: mbechler/marshalsec — Marshalsec is a toolkit designed for generating malicious serialized Java objects to achieve remote code execution… pwntester/ysoserial.net — ysoserial.net is a payload generator for .NET deserialization, designed to create malicious serialized objects and… voorivex/pentest-guide — This project is a comprehensive web application penetration testing guide and vulnerability research framework. It… 0x727/shuize_0x727 — ShuiZe_0x727 is an open-source intelligence gathering framework and attack surface management tool. It functions as an… zhzyker/exphub — Exphub is a CVE exploit script library and enterprise software vulnerability suite designed to verify and exploit… lijiejie/swagger-exp — A Swagger API Exploit.

SpringBootVulExploit

Features

Istoric stele

SpringBootVulExploit

Features

Alternative open-source pentru SpringBootVulExploit

mbechler/marshalsec

Voorivex/pentest-guide

pwntester/ysoserial.net

0x727/ShuiZe_0x727

Întrebări frecvente

Istoric stele

Alternative open-source pentru SpringBootVulExploit

mbechler/marshalsec

Voorivex/pentest-guide

pwntester/ysoserial.net

0x727/ShuiZe_0x727

Întrebări frecvente