Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add checks for Spring Boot Actuator endpoints #41

Closed
gingeleski opened this issue Dec 5, 2019 · 2 comments
Closed

Add checks for Spring Boot Actuator endpoints #41

gingeleski opened this issue Dec 5, 2019 · 2 comments

Comments

@gingeleski
Copy link
Contributor

Consider adding checks for Spring Boot Actuator, which if openly accessible in production can be leveraged to run trace, dump memory, manipulate environment variables, etc. [1][2][3]

Looks like patterns might be added here to directories.dat.

/actuator
/actuator/auditevents
/actuator/autoconfig
/actuator/beans
/actuator/caches
/actuator/conditions
/actuator/configprops
/actuator/env
/actuator/flyway
/actuator/health
/actuator/httptrace
/actuator/info
/actuator/integrationgraph
/actuator/loggers
/actuator/liquibase
/actuator/metrics
/actuator/mappings
/actuator/scheduledtasks
/actuator/sessions
/actuator/shutdown
/actuator/threaddump
/actuator/heapdump
/actuator/jolokia
/actuator/logfile
/actuator/prometheus
@stanislav-dev
Copy link

PLease create pull request

gingeleski added a commit to gingeleski/OpenDoor that referenced this issue May 9, 2020
@gingeleski
stanislav-web#41 git ignore virtual env, ahead of making this change
14c2103
gingeleski added a commit to gingeleski/OpenDoor that referenced this issue May 9, 2020
@gingeleski
stanislav-web#41 expand directories.dat to look for spring actuator
ca938ec
@gingeleski gingeleski mentioned this issue May 9, 2020
Merged
@gingeleski
Copy link
Contributor Author

Done, thank you.

stanislav-web pushed a commit that referenced this issue Feb 23, 2021
Merge pull request #42 from gingeleski/master
5a20088 
Issue #41 - Check for Spring Actuator endpoints during scan
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@gingeleski @stanislav-dev