hunt-springboot

Detect and exploit Spring Boot vulnerabilities via actuator endpoints and SpEL injection.

Updated Jul 1, 2026

Search Tags:#vulnerability detection #Spring Boot #actuator #heap dump #SpEL

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-springboot-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-springboot
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-springboot
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-springboot-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill is designed to detect and exploit vulnerabilities specific to Spring Boot applications, such as actuator endpoints and Spring Expression Language (SpEL) injection.

Core Features & Use Cases

Actuator Endpoint Enumeration: Identifies and validates the presence of Spring Boot actuator endpoints.
SpEL Injection Detection: Identifies and confirms SpEL injection vulnerabilities in Spring applications.
Heap Dump Analysis: Extracts credentials and secrets from Spring Boot heap dumps.
Use Case: For security professionals auditing Spring Boot applications, this Skill automates the process of identifying common vulnerabilities and assessing their potential impact.

Quick Start

Run the hunt-springboot skill against a target Spring Boot application to enumerate its actuator endpoints and check for common vulnerabilities.

Frequently Asked Questions about hunt-springboot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Spring Boot actuator endpoints for vulnerabilities?▼

Scanning Spring Boot actuator endpoints involves enumerating exposed routes to identify security issues. This Skill automates actuator endpoint discovery and validates their presence to assess potential exploitability in target applications.

Can I extract credentials from a Spring Boot heap dump?▼

Yes, extracting credentials from a Spring Boot heap dump is achievable. This Skill analyzes heap dumps to automatically locate and extract secrets, credentials, and sensitive data left exposed by misconfigured actuator endpoints.

How do I detect SpEL injection in Spring Boot applications?▼

Detecting SpEL injection in Spring Boot applications requires identifying vulnerable expression evaluation points. This Skill identifies and confirms SpEL injection vulnerabilities by testing input vectors against Spring's expression language parsing mechanisms.

What prerequisite knowledge is needed to audit Spring Boot security?▼

Auditing Spring Boot security requires knowledge of the framework, associated attack vectors, and actuator configurations. This Skill is designed for security professionals and red teamers familiar with exploiting Spring Boot vulnerabilities.

Are exposed Spring Boot actuators a security risk?▼

Exposed Spring Boot actuators are a significant security risk because they reveal sensitive operational data. This Skill identifies misconfigured actuator endpoints, enabling security professionals to assess application exposure and prevent data leakage.

Does this Skill work for red teaming Spring Boot environments?▼

Yes, this Skill works for red teaming Spring Boot environments by automating vulnerability detection and exploitation. It supports red teamers by scanning for actuator endpoints, identifying SpEL injection, and analyzing heap dumps.