Detection system and method for springboot actuator vulnerabilities

Abstract

The present application provides a detection method for SpringBoot Actuator vulnerabilities, comprising: inputting a target IP address list to a scanning module, and detecting the network reachability of each IP address in the IP address list; if any IP address is reachable in a network, detecting all ports of the IP address, and recording open port numbers; performing service classification by identifying services running on open ports; if a service is classified to as a SpringBoot Web-type service, determining whether an Actuator path of the service is accessible; if the access is successful, using a crawler module to crawl a Web page under the Actuator path; if the crawled content contains a Heapdump binary file, downloading the Heapdump file to a local computer; parsing the downloaded Heapdump file by means of a parsing module to extract sensitive information from the file; and a detection report module generating a SpringBoot Actuator vulnerability detection report on the basis of the extracted sensitive information.

Description

System and method for detecting springboot actuator vulnerability

[0001] Cross-reference to related applications

[0002] The present application claims priority to the Chinese patent application No. 202411335806.6, filed on September 24, 2024, and entitled "System and method for detecting springboot actuator vulnerability", the entire content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the technical field of vulnerability detection, in particular to a system and method for detecting springboot actuator vulnerability, an electronic device and a storage medium. BACKGROUND

[0004] Actuator is a functional module provided by SpringBoot to introspect and monitor application systems. With the help of Actuator, developers can easily view and count some monitoring indicators of application systems. In the case of enabling Actuator, if no relevant permission control is done, illegal users can obtain monitoring information in the application system by accessing the default actuator endpoint.

[0005] Currently, the vulnerability detection does not have the function of automatically crawling and downloading sensitive files on the web service of SpringBoot, and it is difficult to analyze and extract sensitive information from the sensitive files. Usually, it is necessary to manually log in to the webpage, manually download the sensitive files, and then analyze the files.

[0006] To solve the above problems, a system and method for detecting springboot actuator vulnerability, an electronic device and a storage medium are proposed.

[0007] SUMMARY

[0008] Embodiments of the present application aim to at least solve one of the technical problems existing in the prior art, and provide a system and method for detecting springboot actuator vulnerability, an electronic device and a storage medium.

[0009] In a first aspect, a system for detecting springboot actuator vulnerability is provided, comprising:

[0010] A scanning module is configured to receive a target IP address list, detect the network reachability of each IP address in the IP address list, record the open port number, identify the service running under the open port, and classify the service.

[0011] a crawler module, configured to crawl the web page under the Actuator path, and download the file to the local computer when the Heapdump binary file is detected;

[0012] a parsing module, configured to parse the downloaded Heapdump file and extract sensitive information therefrom;

[0013] a detection report module, configured to generate a SpringBoot Actuator vulnerability detection report according to the extracted sensitive information.

[0014] In a second aspect, the application provides a detection method for a SpringBoot Actuator vulnerability, comprising:

[0015] inputting a target IP address list to the scanning module, and detecting the network reachability of each IP address in the IP address list;

[0016] if there is a network-reachable IP address, detecting all ports of the IP address and recording the open port numbers;

[0017] classifying services by identifying the services running under the open ports;

[0018] if the service is classified as a SpringBoot web service, determining whether the Actuator path of the service can be accessed;

[0019] if the access is successful, using the crawler module to crawl the web page under the Actuator path;

[0020] if the crawled content contains a Heapdump binary file, downloading the Heapdump file to the local computer;

[0021] processing the downloaded Heapdump file by the parsing module, and extracting sensitive information from the file;

[0022] generating a SpringBoot Actuator vulnerability detection report by the detection report module according to the extracted sensitive information.

[0023] In combination with the second aspect, the detection of the network reachability of each IP address in the IP address list comprises sending an ICMP request packet to each IP address by Ping scanning, and determining the network reachability of the IP address according to the response information.

[0024] In combination with the second aspect, if the network-reachable IP address exists, the scanning of all ports of the IP address includes scanning all ports of the target IP address through a TCP SYN scan and / or a TCP Connect scan, and recording in order from 1 to 65535.

[0025] In combination with the second aspect, the service classification by identifying the service running under the open port includes sending a preset data packet to the open port, analyzing the response information by calling an Nmap database, and identifying the type of the service running.

[0026] In combination with the second aspect, the judgment of whether the Actuator path of the service can be accessed includes sending an HTTP request packet to the Actuator path, and confirming whether the Actuator path can be accessed by checking whether the returned HTTP status code is 200.

[0027] In combination with the second aspect, the analysis of the downloaded Heapdump file and the extraction of sensitive information in the file include converting the Heapdump file into a UTF-8 encoded string format, and extracting sensitive information through keyword search, wherein the keywords include a password and a token.

[0028] In combination with the second aspect, the keyword search and the extraction of sensitive information include training the keyword search and the analysis process through machine learning.

[0029] The third aspect of the present application provides an electronic device, which includes:

[0030] one or more processors;

[0031] a storage unit configured to store one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement any one of the above methods for detecting a SpringBoot Actuator vulnerability.

[0032] The fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, can implement any one of the above methods for detecting a SpringBoot Actuator vulnerability.

[0033] The application provides a detection system and method for SpringBoot Actuator vulnerability, an electronic device and a storage medium. The detection system receives a target IP address list input by a scanning module, detects the network reachability and open port of each IP, and identifies and classifies the service type under the port. If it is a SpringBoot Web service, it is further judged whether the Actuator path can be accessed. When the Actuator path is accessible, the contents under the path are crawled by a crawler module, and the Heapdump file is downloaded. Then the Heapdump file is analyzed by an analysis module, sensitive information such as passwords and tokens is extracted, and finally a report containing vulnerability information is generated by a detection report module, so as to realize automatic detection and analysis of SpringBoot Actuator vulnerability, improve detection efficiency and reduce the cost of manual operation. BRIEF DESCRIPTION OF DRAWINGS

[0034] Fig. 1 is a structural schematic diagram of the detection system for SpringBoot Actuator vulnerability in the embodiment of the application;

[0035] Fig. 2 is a flowchart of the detection method for SpringBoot Actuator vulnerability in the embodiment of the application;

[0036] Fig. 3 is a structural schematic diagram of the electronic device in the embodiment of the application. DETAILED DESCRIPTION

[0037] The exemplary embodiments will be described in detail herein with reference to the drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the application.

[0038] The terms used in the embodiments of the application are only for the purpose of describing specific embodiments, and are not intended to limit the embodiments of the application. The singular forms "a", "an" and "the" used in the embodiments of the application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein means and includes any or all possible combinations of one or more associated listed items.

[0039] It should be understood that, although the embodiments of the present application can adopt the terms first, second, third, etc. to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0040] As shown in Figure 1, it is a structural schematic diagram of the detection system for SpringBoot Actuator vulnerability of the embodiments of the present application. It includes:

[0041] The scanning module 110 is configured to receive a target IP address list, detect the network accessibility of each IP address in the IP address list, and record the open port number, identify the service running under the open port, and perform service classification.

[0042] The crawler module 120 is configured to crawl the web page under the Actuator path, and download the file to the local when the Heapdump binary file is detected.

[0043] The analysis module 130 is configured to analyze the downloaded Heapdump file, and extract the sensitive information therein.

[0044] The detection report module 140 is configured to generate a SpringBoot Actuator vulnerability detection report according to the extracted sensitive information.

[0045] Specifically, the scanning module 110 is configured to receive a target IP address list, i.e. a group of IP addresses input by a user or identified by a system, which represent servers or devices that may have SpringBoot services. The module detects the network accessibility of each IP to determine whether these servers can be accessed through the network.

[0046] The network accessibility detection is realized by an ICMP Ping request or other network protocols (not specifically limited in the embodiments).

[0047] After recording the open port number, the module identifies the service running under each port. The services include HTTP, HTTPS, FTP, SSH, etc.

[0048] Based on the open ports and services, the scanning module classifies these services, especially SpringBoot Web class services, with Actuator interfaces for monitoring and managing applications.

[0049] The crawler module 120 performs web page crawling (i.e., accessing and obtaining page content) on the Actuator path in the case of detecting SpringBoot Web class services. The Actuator path is a management endpoint provided by SpringBoot, which may expose some internal information of the system. If the crawler detects the existence of a Heapdump binary file, it will be downloaded to the local computer.

[0050] The crawler module generally uses HTTP requests and relies on crawler libraries in scripting languages such as Python (e.g., Scrapy, BeautifulSoup, etc.) to obtain the content of target web pages. Heapdump is a memory dump file of a Java program, which may contain sensitive information such as object instances, variables, and passwords. If such files are not properly protected, they may leak the internal state of the application.

[0051] The parsing module 130 analyzes and processes the downloaded Heapdump file. The Heapdump file is essentially a large binary file that contains the memory data of the application at runtime. The parsing module converts this data into a readable format (e.g., UTF-8 encoded text) using tools or scripts and extracts sensitive information from it.

[0052] Sensitive information can be passwords, tokens, API keys, database connection information, etc. If these data are obtained by illegal users, it may cause security risks to the system.

[0053] The parsing module can use keyword matching and regular expression techniques, or machine learning algorithms to automatically improve the accuracy of sensitive information detection.

[0054] The detection report module 140 generates a detection report on the SpringBoot Actuator vulnerability based on the sensitive information extracted by the parsing module. The report lists in detail which IP and port have vulnerabilities, which sensitive information is found, and may provide suggestions for repair measures.

[0055] The report generation includes vulnerability description, risk level assessment, leaked sensitive data, and defense or repair suggestions. The generated report can provide detailed repair guidance for security teams or system administrators, so as to quickly eliminate security risks.

[0056] Beneficial effects: The four modules form a complete vulnerability detection system. The scanning module is responsible for collecting and analyzing the network information of the target; the crawler module is responsible for crawling and downloading potential vulnerability files; the parsing module analyzes the sensitive information in the files; and the detection report module is responsible for the final output of the operational report. The entire system realizes the automatic detection and analysis of SpringBoot Actuator vulnerabilities, greatly reducing the need for manual intervention and improving security detection efficiency.

[0057] As shown in FIG. 2, it is a flowchart of the detection method for SpringBoot Actuator vulnerabilities according to the embodiment of the application. It includes:

[0058] S201: input the target IP address list to the scanning module, and detect the network reachability of each IP address in the IP address list;

[0059] S202: if there is a network reachable IP address, detect all ports of the IP address and record the open port number;

[0060] S203: classify the services by identifying the services running under the open ports;

[0061] S204: if the service is classified as a SpringBoot web service, determine whether the Actuator path of the service can be accessed;

[0062] S205: if the access is successful, use the crawler module to crawl the web page under the Actuator path;

[0063] S206: if the crawled content contains a Heapdump binary file, download the Heapdump file to the local computer;

[0064] S207: use the parsing module to parse the downloaded Heapdump file, and extract the sensitive information in the file;

[0065] S208: the detection report module generates a SpringBoot Actuator vulnerability detection report according to the extracted sensitive information.

[0066] Specifically, the target IP address list is input to the scanning module, and the network reachability of each IP address in the IP address list is detected.

[0067] The user or system administrator provides a list containing multiple target IP addresses to the scanning module, and the system detects the reachability of these IP addresses one by one.

[0068] Network reachability refers to whether a target IP address can communicate under current network conditions. This is usually achieved by sending an ICMP request (such as Ping). If the target address responds to the Ping request, it indicates that it is network-reachable; otherwise, it may be unreachable due to firewalls, network problems, etc.

[0069] In addition to ICMP Ping, other protocols (such as TCP or UDP) can also be used to detect reachability. Reachability detection is a prerequisite for vulnerability scanning, ensuring that subsequent operations target valid IP addresses.

[0070] If there is a network-reachable IP address, all ports of the IP address are probed, and the open port numbers are recorded.

[0071] Once the IP address is confirmed to be reachable, the system probes the status of all ports under the IP address and records the open port numbers.

[0072] Port scanning is a basic operation in network security, which helps identify services running on target systems. Generally, TCP SYN scanning or TCP Connect scanning is used to probe from port 1 to 65535.

[0073] Sometimes specific ports are used to expose SpringBoot services (such as 8080, 443, etc.), but to ensure comprehensive coverage, full port scanning is performed. The record of open ports lays the foundation for the next step of service classification.

[0074] By identifying the services running under open ports, service classification is performed.

[0075] The system classifies services based on the services running on open ports, such as HTTP, HTTPS, SSH, FTP, etc.

[0076] Identifying services running under open ports is usually done by sending specific request packets to the port and analyzing the response to identify the service type. Many scanning tools (such as Nmap) have built-in service identification functions that can accurately identify common services.

[0077] The key to this step is to accurately identify web services, especially SpringBoot services. Service classification helps narrow the scope of vulnerability detection, further improving the efficiency of vulnerability detection.

[0078] If the service is classified as a SpringBoot web service, determine whether the Actuator path of the service can be accessed.

[0079] If a SpringBoot web service is detected running under an open port, the system will attempt to access the Actuator path of the service.

[0080] The Actuator path is a management and monitoring interface provided by the Spring Boot framework. If it is exposed without protection, it may expose sensitive system information. Access to this path is achieved by sending an HTTP request; a 200 status code (success) indicates that access to the path is permitted.

[0081] Actuator's paths and permission configurations are sometimes exposed by default, making them vulnerable to exploitation. Attackers can use these paths to obtain the system's running status, thread information, and even memory data.

[0082] If the access is successful, use the crawler module to crawl the web pages under the Actuator path.

[0083] If the Actuator path is successfully accessed, the system will launch the crawler module to fully crawl the pages under that path and collect all the content on the pages.

[0084] A web crawler is an automated script that can traverse and download content from a target website. In this step, the crawler visits all potentially exposed Actuator subpaths, attempting to obtain system runtime status, memory dumps (such as Heapdump), and other files.

[0085] The crawler module can identify and capture sensitive files in web pages, ensuring that no potentially vulnerable files, such as Heapdump or other log files, are missed.

[0086] If the crawled content contains a Heapdump binary file, download the Heapdump file to your local computer.

[0087] If a Heapdump binary file is found in the crawled web pages, the system will download it to the local machine for further analysis.

[0088] A heapdump is a memory dump file generated by the Java Virtual Machine during runtime. It contains the current memory state of an application and may expose sensitive information such as usernames, passwords, and tokens. Therefore, downloading a heapdump file is an important step in detecting sensitive information.

[0089] Heapdump files can be very large, so performance and efficiency must be ensured during download and parsing. Furthermore, these files are often unencrypted or unprotected, and unauthorized access to them could lead to serious security risks.

[0090] The downloaded Heapdump file is parsed using a parsing module to extract sensitive information from the file.

[0091] The downloaded Heapdump file will be analyzed by the parsing module to extract any sensitive information that may be present.

[0092] The parsing module converts the binary content of the Heapdump into a readable text format and uses keyword matching (such as password, token, session, etc.) to identify sensitive information. The parsing process can be improved in accuracy through regular expressions, string matching, or even machine learning techniques.

[0093] Heapdump files contain not only sensitive string information, but also complex object instances that may reveal system design and architecture. Parsing strategies can be customized for different application types.

[0094] The detection report module generates a SpringBoot Actuator vulnerability detection report based on the extracted sensitive information.

[0095] The system generates a detailed vulnerability detection report based on the sensitive information extracted from the Heapdump file.

[0096] The detection report is the final output of the vulnerability detection, which lists the detected vulnerabilities, exposed sensitive information, affected endpoints, and repair suggestions. The report can provide a clear action guide for system administrators or security teams to help them patch vulnerabilities and protect system security.

[0097] The detection report can also include an overall assessment of system security, priority ranking, and risk level assessment to help users prioritize the repair of high-risk vulnerabilities. The report can be generated in formats such as PDF, HTML, etc., for easy sharing and archiving.

[0098] Beneficial effects: Through a series of automated steps, the complete chain from target IP detection, port identification, service classification, to vulnerability identification, file crawling and sensitive information parsing, and finally to vulnerability detection report generation is completed. This method significantly improves the detection efficiency of SpringBoot Actuator vulnerabilities, reduces the complexity of manual operations, and through automated tools, efficiently extracts and analyzes sensitive information, helping enterprises and users to discover and repair potential security risks in a timely manner.

[0099] Further, the detection of network reachability of each IP address in the IP address list includes sending an ICMP request packet to each IP address through Ping scanning, and determining the network reachability of the IP address according to the response information.

[0100] The system uses ICMP request packets (Internet Control Message Protocol) to test whether each target IP address can respond through Ping scanning. This process is used to determine whether the target IP is reachable in the network.

[0101] ICMP Ping scanning is one of the common methods in network probing, which can quickly determine whether an IP address is online. Ping scanning sends request packets (ICMP Echo Request) and waits for response packets (ICMP Echo Reply). If the target host is online and not blocked by the firewall, it will usually reply with a response packet.

[0102] In some high-security network environments, ICMP request packets may be blocked by firewalls or other security mechanisms, so this process may require alternative solutions such as TCP SYN scanning or UDP scanning to ensure effective probing in various network environments.

[0103] If there are network-reachable IP addresses, all ports of the IP address are probed, including scanning all ports of the target IP address through TCP SYN scanning and / or TCP Connect scanning, and recording them in order from 1 to 65535.

[0104] If the target IP address is found to be reachable, the system will perform a full port scan on the IP address to check whether all ports on the IP are open. Common scanning techniques include TCP SYN scanning and TCP Connect scanning.

[0105] TCP SYN scanning is the most common port scanning method, which checks the port state by sending a TCP SYN packet (synchronization request packet). If the target port responds with a SYN-ACK packet, it indicates that the port is open. TCP Connect scanning attempts to establish a complete TCP connection to determine whether the port is open.

[0106] Full port scanning is a core step in network security because some services may run on non-standard ports (such as not using common ports 80, 443, etc.), and full port scanning ensures that all potential vulnerabilities are detected. For large-scale scanning, the system can be parallelized to improve efficiency.

[0107] The service classification by identifying the services running on the open ports includes sending preset data packets to the open ports, analyzing the response information by calling the Nmap database, and identifying the type of service running.

[0108] The system sends specific preset data packets to the open ports and calls the Nmap database to analyze the type of service running on the port.

[0109] Nmap is a widely used network scanning and security auditing tool that has strong service identification capabilities. It can determine the specific services running on a port (such as HTTP, FTP, SSH, etc.) by analyzing the response packets of the port.

[0110] In addition to calling the Nmap database, the system can also integrate other service identification libraries or technologies, such as Masscan, to further improve the accuracy and efficiency of service identification. Correctly identifying the type of service helps to narrow down the scope of vulnerability detection and perform relevant security scans for specific services.

[0111] If the service is classified as a SpringBoot web service, the system determines whether the Actuator path of the service can be accessed by sending an HTTP request packet to the Actuator path and checking whether the returned HTTP status code is 200.

[0112] If the open port is running a SpringBoot web service, the system sends an HTTP request packet to its Actuator path and determines whether it can successfully access the path based on the returned HTTP status code.

[0113] The Actuator path is the management and monitoring interface of the SpringBoot application, which is open by default. If the returned HTTP status code is 200 (indicating success), it means that the path can be accessed, and sensitive information may be exposed. If other status codes are returned (such as 401 unauthorized, 403 forbidden, etc.), it means that the Actuator interface has been protected.

[0114] Accessing the Actuator path not only allows you to obtain monitoring data, but also may expose the health information and memory dump of the application. To prevent unauthorized access, developers usually need to protect these paths through permission control, identity verification, and other means.

[0115] The analysis and processing of the downloaded Heapdump file to extract sensitive information includes converting the Heapdump file to a UTF-8 encoded string format and extracting sensitive information through keyword search, including "password" and "token".

[0116] When the Heapdump file is downloaded locally, the system will parse it into a UTF-8 encoded string format and extract sensitive information through keyword search (such as "password" and "token").

[0117] Heapdump files are memory snapshots of Java applications, containing the current memory state of the application and potentially leaking a large amount of sensitive information. By converting the binary format to readable UTF-8 strings, the system can easily search for potential security risks.

[0118] In addition to simple keyword matching, the system can further analyze variable names, object instances, and other complex data structures, even using semantic analysis techniques to identify hidden sensitive information. Keyword search can be automated, but requires adjusting the keyword list according to the characteristics of the application.

[0119] The keyword search, extracting sensitive information includes training the keyword search and parsing process through machine learning.

[0120] During the keyword search process, the system uses machine learning algorithms to optimize the accuracy of extracting sensitive information and improve the efficiency of the search and parsing process.

[0121] Machine learning can learn how to identify and extract sensitive information by training a large number of sample data. It can improve the ability to identify a variety of data, such as different formats of passwords, tokens, personal information, etc. The trained model can improve the accuracy of the search in practical applications and reduce false positives and false negatives.

[0122] The training data of the machine learning model should contain various formats of sensitive information (such as plaintext passwords, hashed passwords, API keys, etc.) so that the model can be widely adapted to different scenarios. The model can also be customized according to the needs of specific fields to further enhance the detection ability of sensitive information.

[0123] Beneficial effects: Through Ping scanning, port scanning, service classification, crawler download and keyword search, etc. The system can automatically detect SpringBoot Actuator vulnerabilities. Through these technologies, the system can effectively identify and process exposed Heapdump files, extract sensitive information and generate vulnerability reports. With the help of advanced tools and technologies such as Nmap database, Python crawler scripts and machine learning, this application improves the efficiency and accuracy of vulnerability detection, helping users to discover and repair potential security risks in the system in a timely manner.

[0124] Embodiments of the present application provide a detection system and method for SpringBoot Actuator vulnerabilities, an electronic device and a storage medium. The system receives a list of target IP addresses input by a scanning module, detects the network reachability and open ports of each IP, and identifies and classifies the service types under the ports. If it is a SpringBoot Web service, it further judges whether the Actuator path can be accessed. When the Actuator path is accessible, the contents under the path are crawled using a crawler module, and the Heapdump file is downloaded. Then the Heapdump file is analyzed by the analysis module, and sensitive information such as passwords and tokens is extracted. Finally, the detection report module generates a report containing vulnerability information, thereby realizing automatic detection and analysis of SpringBoot Actuator vulnerabilities, improving detection efficiency and reducing the cost of manual operation.

[0125] The electronic device 300 can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. The electronic device 300 can include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art can understand that FIG. 3 is only an example of the electronic device 300, and does not constitute a limitation on the electronic device 300, and can include more or fewer components than those shown, or combine certain components, or different components, for example, the electronic device can also include an input / output device, a network access device, a bus, and the like.

[0126] The processor 301 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, or the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0127] The memory 302 can be an internal storage unit of the electronic device 300, for example, a hard disk or a memory of the electronic device 300. The memory 302 can also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Alternatively, the memory 302 can include both an internal storage unit and an external storage device of the electronic device 300. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0128] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional units and modules is exemplified, and in actual application, the above functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software functional unit. In addition, the specific names of each functional unit and module are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the units and modules in the above system can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0129] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0130] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0131] In the embodiments of the present application, it should be understood that the disclosed apparatus / equipment and method can be implemented in other manners. For example, the embodiments of the apparatus / equipment described above are merely schematic, and the division of the modules or units can be changed or integrated, or some features can be ignored or not executed. In addition, the display or discussion about the coupling or direct coupling or communication connection between the modules can be achieved through some interfaces, and can be indirect coupling or communication connection between the modules, and can be electrical, mechanical or other forms.

[0132] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e. may be located in one place or distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0133] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0134] If the integrated module / unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by computer programs instructing related hardware, and the computer programs can be stored in a computer readable storage medium. The computer program can be executed by a processor to implement the steps of each method embodiment. The computer program can include computer program code, which can be in the form of source code, object code, executable file or some intermediate form. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. Optionally, the readable storage medium is a non-transitory readable storage medium. It should be noted that the content contained in the computer readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

[0135] The above examples are only used to illustrate the technical solutions of the present application, but not to limit the present application; although the present application has been described in detail with reference to the foregoing examples, those ordinarily skilled in the art should understand: the technical solutions recorded in the foregoing examples can still be modified, or some technical features can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A detection system for SpringBoot Actuator vulnerabilities, characterized in that, include: The scanning module is used to receive a list of target IP addresses, detect the network reachability of each IP address in the list, record open port numbers, identify services running on open ports, and classify the services. The crawler module is used to crawl web pages under the Actuator path and download the Heapdump binary file to the local machine when it is detected. The parsing module is used to parse the downloaded Heapdump file and extract sensitive information from it; The detection report module is used to generate SpringBoot Actuator vulnerability detection reports based on the extracted sensitive information.

2. A detection method for a SpringBoot Actuator vulnerability, characterized in that, include: Input a list of target IP addresses into the scanning module and detect the network reachability of each IP address in the list; If a network-reachable IP address exists, probe all ports of that IP address and record the open port numbers; Services are categorized by identifying the services running under open ports; If the service is classified as a Spring Boot Web service, determine whether the Actuator path of the service can be accessed; If the access is successful, use the crawler module to crawl the web pages under the Actuator path; If the crawled content contains a Heapdump binary file, download the Heapdump file to the local computer; The downloaded Heapdump file is parsed using a parsing module to extract sensitive information from the file; The detection report module generates a SpringBoot Actuator vulnerability detection report based on the extracted sensitive information.

3. The method of claim 2, wherein, The process of detecting the network reachability of each IP address in the IP address list includes sending ICMP request packets to each IP address via Ping scan and determining the network reachability of the IP address based on the response information.

4. The method of claim 2, wherein, If a network-reachable IP address exists, probing all ports of that IP address includes scanning all ports of the target IP address through TCP SYN scanning and / or TCP Connect scanning, and recording them in order from 1 to 65535.

5. The method of claim 2, wherein, The process of identifying and classifying services running on open ports includes sending preset data packets to the open ports, analyzing response information by calling the Nmap database, and identifying the type of service being run.

6. The method of claim 2, wherein, If the service is classified as a Spring Boot Web service, determining whether the Actuator path of the service can be accessed includes sending an HTTP request packet to the Actuator path and checking whether the returned HTTP status code is 200 to confirm whether access is possible.

7. The method of claim 2, wherein, The process of parsing the downloaded Heapdump file and extracting sensitive information from the file includes converting the Heapdump file into a UTF-8 encoded string format and extracting sensitive information through keyword retrieval, whereby the keywords include password and token.

8. The method of claim 7, wherein, The keyword search and the extraction of sensitive information include training the keyword search and the parsing process by machine learning.

9. An electronic device, comprising: The method comprises the following steps: one or more processors; a storage unit for storing one or more programs, which, when executed by the one or more processors, can enable the one or more processors to implement the detection method for the SpringBoot Actuator vulnerability according to any one of claims 2 to 8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, can implement the detection method for the SpringBoot Actuator vulnerability according to any one of claims 2 to 8.

Images