Springboot Basic Test

Apr 14, 2023#渗透 #springboot105

AI Translation

This post is translated from Chinese into English through AI.View Original

AI-generated summary

The article discusses how sensitive information like passwords can be extracted from the /actuator/env endpoint in SpringBoot websites using tools like SpringBoot-Scan and JDumpSpider. The article also provides sample code for extracting passwords from LinkedHashMap and Hashtable using SQL queries.

123

Find * Password#

In the SpringBoot site, there is an endpoint named /actuator/env. Usually, this endpoint will shield some sensitive information, such as passwords, and replace them with asterisks. If the target website can download the file /actuator/heapdump or /heapdump and decode it, sensitive information contained in it can be extracted.

You can also use this tool to scan SpringBoot nodes.

AabyssZG/SpringBoot-Scan

针对SpringBoot的开源渗透框架，以及Spring相关高危漏洞利用工具

Python1393134

mat#

select * from java.util.LinkedHashMap$Entry x WHERE (toString(x.key).contains("password"))
select * from java.util.Hashtable$Entry x WHERE (toString(x.key).contains("password"))

JDumpSpider#

Project address: https://github.com/whwlsfb/JDumpSpider

$ java -jar JDumpSpider-1.0-SNAPSHOT-full.jar heapdump

Image from: https://wallhaven.cc/