很棒的工具 about springspider

[whwlsfb]

还有这个位置，并且还要添加页面检查相关的逻辑，因为不是简单 StatusCode == 200就算检测到的。

SpringSpider/src/main/java/burp/scanner/sub/SpringActuator.java

Lines 16 to 59 in fb9de43

	private final List<Payload> payloads = new ArrayList<Payload>() {{
	add(new Payload(new ArrayList<String[]>() {{
	add(new String[]{"env"});
	add(new String[]{"actuator", "env"});
	}}, (baseRequestResponse, checkRequest, newUrl) -> {
	IResponseKeywords founds = Utils.Helpers.analyzeResponseKeywords(new ArrayList<String>() {{
	add("java.version");
	add("os.arch");
	}}, checkRequest.getResponse());
	if (BypassPayloadUtils.hasFound(founds, 0) && Utils.Helpers.analyzeResponse(checkRequest.getResponse()).getStatusCode() == 200) {
	Utils.Callback.printOutput("found " + newUrl + ".\r\n");
	return new Issue(
	baseRequestResponse.getHttpService(),
	newUrl,
	new IHttpRequestResponse[]{checkRequest},
	"Spring Actuator-Env found.",
	"URL: " + newUrl,
	"Medium", true);
	} else {
	return null;
	}
	}));
	add(new Payload(new ArrayList<String[]>() {{
	add(new String[]{"actuator"});
	}}, (baseRequestResponse, checkRequest, newUrl) -> {
	IResponseKeywords founds = Utils.Helpers.analyzeResponseKeywords(new ArrayList<String>() {{
	add("health");
	add("{\"self\":{");
	add("{\"_links\":{");
	}}, checkRequest.getResponse());
	if (BypassPayloadUtils.hasFound(founds, 0) && Utils.Helpers.analyzeResponse(checkRequest.getResponse()).getStatusCode() == 200) {
	Utils.Callback.printOutput("found " + newUrl + ".\r\n");
	return new Issue(
	baseRequestResponse.getHttpService(),
	newUrl,
	new IHttpRequestResponse[]{checkRequest},
	"Spring Actuator found.",
	"URL: " + newUrl,
	"Medium", false);
	} else {
	return null;
	}
	}));
	}};

[whwlsfb]

而且建议不要添加heapdump的检查，这个文件一般比较庞大，不适合用在扫描场景

[able9527]

嗯嗯，我试着改下，感谢师傅