What problem does it solve? Security testers assessing Spring Boot applications often produce false positives from scanner hits, whitelabel error pages, or port scans without confirming actual exposure. This Skill enforces an evidence-gated workflow that confirms Spring applications, Actuator endpoints, versions, and configurations before declaring any advisory applicability. ## Core Features & Use Cases - Evidence-Gated Validation: Requires baseline, single-variable probes, and server/browser oracle confirmation before accepting any finding, rejecting WAF blocks, captchas, and scanner hits as inconclusive. - Read-Only Safe Probing: Restricts testing to publicly exposed health/version metadata and self-owned canary routes, stopping immediately at env/heapdump reads, management writes, or JNDI/deserialization chains. - CVE Applicability Checks: Confirms product, version, module, and exposed interface conditions against advisories, routing confirmed CVEs to the bb-methodology workflow. - Use Case: During an authorized assessment, you detect an Actuator endpoint on a target. Use this Skill to verify whether management interfaces genuinely expose non-public configuration data, with documented endpoint, auth, and version evidence. ## Quick Start Use $hunt-springboot to plan an evidence-gated, authorized validation path for the Spring Boot target in scope.
