id: springboot-actuator

info:
  name: Detect Springboot Actuators
  author: that_juan_,dwisiswant0,wdahlenb,dr0pd34d,TheZakMan
  severity: info
  metadata:
    max-request: 4
    shodan-query: http.favicon.hash:116323821
  tags: tech,springboot,actuator,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/actuator"
      - "{{BaseURL}}/actuator%72"
      - "{{BaseURL}}/favicon.ico"
      - "{{BaseURL}}/actuator/favicon.ico"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - '"_links":'
          - '"self":'
          - '"health"'
        condition: and

      - type: dsl
        name: "favicon"
        dsl:
          - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))"

    extractors:
      - type: json
        name: available-endpoints
        json:
          - .[] | to_entries | .[].key
# digest: 4b0a00483046022100e91077a42c41d049cae2dbd7905ef69553205ec5f0c906dcb0c502eda36c4601022100f2c3c3abd153a62214892aa3956fc8a2086ec555a361f33f01c942fcf7d6ef13:922c64590222798bb761d5b6d8e72950