Spring Boot Attack Probe

Authorized probe of a Spring Boot 3.x app the user owns. Follow shared probing conventions — discover base URL from application.{properties,yml} server.port (default 8080), Dockerfile EXPOSE, or docker-compose.yml. Never hardcode.

Spring-specific attack surface

• Actuator endpoints under /actuator/* are gold mines: /env (env vars including secrets), /heapdump (full heap → JWT secrets), /loggers (POST to change log level → log injection), /configprops, /threaddump. Easy to expose via management.endpoints.web.exposure.include=*.
• /h2-console is enabled in dev profile — any process with HTTP access can run SQL via JDBC URL pointing back to the app's DB.
• Whitelabel error page discloses package/class names and Spring version.
• Mass-assignment via @ModelAttribute: extra form fields auto-bind to entity fields including id, roles unless setAllowedFields is restricted.
• @RequestParam type coercion + missing @PreAuthorize = "everyone is the admin user" via ?userId=1.

Procedure

1. Authorization preflight + base URL discovery.
2. Liveness: GET /, GET /actuator.
3. Run rules. Several Actuator endpoints are read-only; some (/loggers, /env) accept POSTs — never write to non-test environments.

Rules