Spring Boot Security Scanner
Authorization required. Confirm context: pentest engagement, defensive review, CTF, or research.
Automated Scripts
SKILL_DIR="${CLAUDE_PLUGIN_ROOT:-$(dirname "$0")/..}/skills/pentest"
# Full scan (runs all scanners, outputs JSON + markdown report)
bash "$SKILL_DIR/scripts/scan-runner.sh" src/main
# Individual scanners
bash "$SKILL_DIR/scripts/endpoint-mapper.sh" src/main
bash "$SKILL_DIR/scripts/secrets-scanner.sh" .
bash "$SKILL_DIR/scripts/injection-scanner.sh" src/main
bash "$SKILL_DIR/scripts/security-config-audit.sh" .
bash "$SKILL_DIR/scripts/dependency-checker.sh" .
4-Phase Scan Methodology
Phase 1 — Reconnaissance: endpoint-mapper.sh + security-config-audit.sh. Read project-profile.json. Identify auth mechanism (JWT, session, OAuth2).
Phase 2 — OWASP Top 10 + Spring-Specific: A01–A10 with Spring risks (SpEL injection, Actuator exposure, Jackson deser). See references/scan-methodology.md for mapping table + vulnerability matrix.
Phase 3 — Spring-Critical Deep-Dive: RCE vectors: SpEL injection, Actuator chains, Jackson enableDefaultTyping(), mass assignment, SecurityFilterChain ordering. See references/attack-patterns.md.
Phase 4 — Report: Save to .claude/docs/security/pentest-report-{date}.md with severity counts, findings (file, evidence, attack vector, fix), tool recommendations.
Severity Classification
| Severity |
Criteria |
Examples |
| CRITICAL |
RCE, auth bypass, data breach |
SpEL injection, exposed actuator/heapdump, enableDefaultTyping() |
| HIGH |
Privilege escalation, data exposure |
Missing @PreAuthorize, IDOR, hardcoded secrets |
| MEDIUM |
Defense-in-depth gap |
CSRF disabled, missing @Valid, weak hashing |
| LOW |
Best practice violation |
Missing security headers, unscoped @RequestMapping |
References
- Scan methodology — OWASP Top 10 mapping table, Spring-critical vulnerability matrix, report template
- Attack patterns — SpEL injection, Jackson deser, mass assignment, SecurityFilterChain, actuator chains
- Actuator exploitation — RCE chains, data leak endpoints, secure configuration
- OWASP Top 10 — Detection commands, vulnerable vs secure code per category
- Spring CVEs — Real CVEs (2022-2026) with detection and mitigation
Related Skills
- spring-security — SecurityFilterChain configuration, JWT validation, CORS
- observability-patterns — PII logging detection (A09), audit trail
- testing-workflow — Security test phase in verification pipeline
1---2name: pentest3description: Spring Boot security scanner — OWASP Top 10, SpEL injection, Actuator exploitation, Jackson deserialization, mass assignment, and Spring Security misconfiguration detection. Includes 6 automated scanning scripts and real CVE patterns. Use when performing security reviews, penetration testing, vulnerability assessments, security audits, or checking for known CVEs in Spring Boot projects. Run /pentest-scan for automated full-project scan.4---56# Spring Boot Security Scanner78**Authorization required.** Confirm context: pentest engagement, defensive review, CTF, or research.910## Automated Scripts1112```bash13SKILL_DIR="${CLAUDE_PLUGIN_ROOT:-$(dirname "$0")/..}/skills/pentest"1415# Full scan (runs all scanners, outputs JSON + markdown report)16bash "$SKILL_DIR/scripts/scan-runner.sh" src/main1718# Individual scanners19bash "$SKILL_DIR/scripts/endpoint-mapper.sh" src/main20bash "$SKILL_DIR/scripts/secrets-scanner.sh" .21bash "$SKILL_DIR/scripts/injection-scanner.sh" src/main22bash "$SKILL_DIR/scripts/security-config-audit.sh" .23bash "$SKILL_DIR/scripts/dependency-checker.sh" .24```2526## 4-Phase Scan Methodology2728**Phase 1 — Reconnaissance:** `endpoint-mapper.sh` + `security-config-audit.sh`. Read `project-profile.json`. Identify auth mechanism (JWT, session, OAuth2).2930**Phase 2 — OWASP Top 10 + Spring-Specific:** A01–A10 with Spring risks (SpEL injection, Actuator exposure, Jackson deser). See **[references/scan-methodology.md](references/scan-methodology.md)** for mapping table + vulnerability matrix.3132**Phase 3 — Spring-Critical Deep-Dive:** RCE vectors: SpEL injection, Actuator chains, Jackson `enableDefaultTyping()`, mass assignment, SecurityFilterChain ordering. See **[references/attack-patterns.md](references/attack-patterns.md)**.3334**Phase 4 — Report:** Save to `.claude/docs/security/pentest-report-{date}.md` with severity counts, findings (file, evidence, attack vector, fix), tool recommendations.3536## Severity Classification3738| Severity | Criteria | Examples |39|----------|----------|---------|40| CRITICAL | RCE, auth bypass, data breach | SpEL injection, exposed actuator/heapdump, `enableDefaultTyping()` |41| HIGH | Privilege escalation, data exposure | Missing @PreAuthorize, IDOR, hardcoded secrets |42| MEDIUM | Defense-in-depth gap | CSRF disabled, missing @Valid, weak hashing |43| LOW | Best practice violation | Missing security headers, unscoped @RequestMapping |4445## References4647- **[Scan methodology](references/scan-methodology.md)** — OWASP Top 10 mapping table, Spring-critical vulnerability matrix, report template48- **[Attack patterns](references/attack-patterns.md)** — SpEL injection, Jackson deser, mass assignment, SecurityFilterChain, actuator chains49- **[Actuator exploitation](references/actuator-exploitation.md)** — RCE chains, data leak endpoints, secure configuration50- **[OWASP Top 10](references/owasp-top10.md)** — Detection commands, vulnerable vs secure code per category51- **[Spring CVEs](references/spring-cves.md)** — Real CVEs (2022-2026) with detection and mitigation5253## Related Skills5455- **spring-security** — SecurityFilterChain configuration, JWT validation, CORS56- **observability-patterns** — PII logging detection (A09), audit trail57- **testing-workflow** — Security test phase in verification pipeline
taipt1504