skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-springboot

Detect Spring Boot-specific vulnerabilities including Actuator endpoints, SpEL injection, and Spring4Shell.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#spring boot#red team#vulnerability hunting#actuator enumeration#SpEL injection#heap dump analysis
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-springboot-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-springboot
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-springboot
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-springboot-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the manual, time-consuming work of identifying Spring Boot-specific security vulnerabilities that are often overlooked by generic web scanners, reducing the risk of critical breaches including remote code execution, credential theft, and service disruption.

Core Features & Use Cases

  • Spring Boot Fingerprinting: Automatically detect Spring Boot applications via unique headers, error pages, and common Actuator base paths.
  • Actuator Endpoint Enumeration: Identify exposed high-impact Actuator endpoints (heapdump, env, shutdown, mappings) to extract secrets, application configuration, and internal API surfaces.
  • High-Severity Vulnerability Testing: Validate for critical flaws including SpEL injection, Spring4Shell (CVE-2022-22965), H2 console RCE, and Jolokia JMX exploitation.
  • Use Case: A penetration tester assessing a Java-based web application can use this Skill to quickly confirm Spring Boot presence, extract plaintext credentials from a heap dump, and validate SpEL injection for RCE without manual trial and error.

Quick Start

Use the hunt-springboot skill to scan the target domain example.com for exposed Spring Boot Actuator endpoints, extract any visible secrets from the /actuator/env endpoint, and test for SpEL injection in user-controlled input fields.

Frequently Asked Questions about hunt-springboot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed Spring Boot Actuator endpoints during a penetration test?▼

To find exposed Spring Boot Actuator endpoints, you need to fingerprint the application and enumerate common base paths like /env, /heapdump, and /mappings. This process identifies high-impact endpoints to extract secrets, application configurations, and internal API surfaces.

Can I extract plaintext credentials from a Spring Boot heap dump?▼

Yes, you can extract plaintext credentials by analyzing Spring Boot heap dumps. When the /actuator/heapdump endpoint is exposed, downloading and parsing the dump allows you to recover sensitive application secrets and credentials embedded in memory.

What is the best way to test for SpEL injection in Java-based web applications?▼

The best way to test for SpEL injection is to inject Spring Expression Language payloads into user-controlled input fields. This validates if the application improperly evaluates expressions, which can lead to remote code execution on the target Spring Boot instance.

How does Spring4Shell vulnerability testing work for CVE-2022-22965?▼

Spring4Shell testing validates the presence of CVE-2022-22965 by sending crafted payloads to the Java-based web application. This high-severity flaw allows attackers to achieve remote code execution through data binding vulnerabilities in the Spring framework.

How do I exploit the H2 console and Jolokia JMX in Spring Boot?▼

Exploiting the H2 console and Jolokia JMX involves targeting exposed Spring Boot configurations to achieve RCE and JMX exploitation. By accessing these misconfigured endpoints, you can execute arbitrary commands and manipulate internal application components.

Related Skills

Explore More Software Engineering Skills→
giuseppe-trisciuogliogiuseppe-trisciuoglio
322

spring-boot-actuator

Configure Spring Boot Actuator endpoints, health probes, and Micrometer metrics.

Community
Intermediate
project-axproject-ax
5

provider-credentials

Manage and retrieve credentials across environment variables and OS-native keychains.

Official
Intermediate
taipt1504taipt1504
3

pentest

Scan Spring Boot projects for security vulnerabilities and misconfigurations.

Community
Advanced
sseshachalasseshachala

hunt-springboot

Scan Spring Boot deployments for exposed Actuator endpoints and SpEL injection risks.

Community
Advanced