nuclei-templates/misconfiguration/springboot/springboot-heapdump.yaml

31 lines
741 B
YAML

id: springboot-heapdump
info:
name: Detect Springboot Heapdump Actuator
author: that_juan_,dwisiswant0,wdahlenb
severity: critical
description: Environment variables and HTTP requests can be found in the HPROF
tags: springboot,exposure
requests:
- method: GET
path:
- "{{BaseURL}}/heapdump"
- "{{BaseURL}}/actuator/heapdump"
max-size: 2097152 # 2MB - Max Size to read from server response
matchers-condition: and
matchers:
- type: binary
part: body
binary:
- "4a4156412050524f46494c45" # "JAVA PROFILE"
- "4850524f46" # "HPROF"
- "1f8b080000000000" # Gunzip magic byte
condition: or
- type: status
status:
- 200