diff --git a/Insecure management interface/README.md b/Insecure management interface/README.md new file mode 100644 index 0000000..da18d8d --- /dev/null +++ b/Insecure management interface/README.md @@ -0,0 +1,9 @@ +# Insecure management interface + +## Springboot-Actuator + +Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the health endpoint provides basic application health information. Some of them contains sensitive info such as `/trace` (by default the last 100 HTTP requests with headers), `/env` (the current environment properties) or `/heapdump` (builds and returns a heap dump from the JVM used by our application). These endpoints are enabled by default in Springboot 1.X. Since Springboot 2.x only `/health` and `/info` are enabled by default. + +the official documentation is located [here](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html) + +## Thanks to diff --git a/Insecure management interface/intruders/springboot_actuator.txt b/Insecure management interface/intruders/springboot_actuator.txt new file mode 100644 index 0000000..1b12a1d --- /dev/null +++ b/Insecure management interface/intruders/springboot_actuator.txt @@ -0,0 +1,52 @@ +auditevents +autoconfig +beans +caches +conditions +configprops +dump +env +flyway +health +heapdump +httptrace +info +integrationgraph +jolokia +logfile +loggers +liquibase +metrics +mappings +prometheus +scheduledtasks +sessions +shutdown +threaddump +trace +actuator/auditevents +actuator/autoconfig +actuator/beans +actuator/caches +actuator/conditions +actuator/configprops +actuator/dump +actuator/env +actuator/flyway +actuator/health +actuator/heapdump +actuator/httptrace +actuator/info +actuator/integrationgraph +actuator/jolokia +actuator/logfile +actuator/loggers +actuator/liquibase +actuator/metrics +actuator/mappings +actuator/prometheus +actuator/scheduledtasks +actuator/sessions +actuator/shutdown +actuator/threaddump +actuator/trace \ No newline at end of file