hunt-metrics-exposure

Finding unauthenticated Prometheus metrics and actuator endpoints involves scanning target web applications for common observability paths. This skill identifies exposed endpoints to extract operational intelligence like database pool states and AI model usage for attack surface mapping.

Exposed Spring Boot Actuator and health check endpoints leak sensitive operational intelligence including third-party service dependencies, database connection pool statuses, AI model usage, and real-time user activity. Attackers leverage this data for further exploitation and infrastructure mapping.

Yes, you can scan Node.js and Go applications for exposed metrics endpoints. This approach applies to modern web applications built with Go, .NET, Java, and Node.js, detecting standard observability tooling and framework-specific health check paths.

To extract AI model usage and database pool states from exposed metrics, this skill analyzes Prometheus metric output and validates critical endpoint exposure. It parses operational data to uncover infrastructure dependencies and circuit breaker statuses.

Yes, this method differentiates between critical actuator leaks and minimal health check false positives. It validates vulnerability exposure by confirming critical endpoints like Spring Boot Actuator /env while flagging uninformative basic health checks.

You should hunt for observability endpoint leaks in a red team engagement when you need to quickly map a target's operational footprint. Discovering exposed metrics helps identify AI tools and infrastructure dependencies for chained attacks like DoS or LLM prompt injection.