# Pentest

> Spring Boot security scanner — OWASP Top 10, SpEL injection, Actuator exploitation, Jackson deserialization, mass assignment, and Spring Security misconfiguration detection. Includes 6 automated scanning scripts and real CVE patterns. Use when performing security reviews, penetration testing, vulnerability assessments, security audits, or checking for known CVEs in Spring Boot projects. Run /pentest-scan for automated full-project scan.

- Skill: `taipt1504/pentest` (Agent Skill, multi-file: 12 files)
- Install (CLI): `npx skillmds@latest add taipt1504/pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/taipt1504/pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: taipt1504 (https://skillmd.com/u/taipt1504)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/taipt1504/pentest

---


# Spring Boot Security Scanner

**Authorization required.** Confirm context: pentest engagement, defensive review, CTF, or research.

## Automated Scripts

```bash
SKILL_DIR="${CLAUDE_PLUGIN_ROOT:-$(dirname "$0")/..}/skills/pentest"

# Full scan (runs all scanners, outputs JSON + markdown report)
bash "$SKILL_DIR/scripts/scan-runner.sh" src/main

# Individual scanners
bash "$SKILL_DIR/scripts/endpoint-mapper.sh" src/main
bash "$SKILL_DIR/scripts/secrets-scanner.sh" .
bash "$SKILL_DIR/scripts/injection-scanner.sh" src/main
bash "$SKILL_DIR/scripts/security-config-audit.sh" .
bash "$SKILL_DIR/scripts/dependency-checker.sh" .
```

## 4-Phase Scan Methodology

**Phase 1 — Reconnaissance:** `endpoint-mapper.sh` + `security-config-audit.sh`. Read `project-profile.json`. Identify auth mechanism (JWT, session, OAuth2).

**Phase 2 — OWASP Top 10 + Spring-Specific:** A01–A10 with Spring risks (SpEL injection, Actuator exposure, Jackson deser). See **[references/scan-methodology.md](references/scan-methodology.md)** for mapping table + vulnerability matrix.

**Phase 3 — Spring-Critical Deep-Dive:** RCE vectors: SpEL injection, Actuator chains, Jackson `enableDefaultTyping()`, mass assignment, SecurityFilterChain ordering. See **[references/attack-patterns.md](references/attack-patterns.md)**.

**Phase 4 — Report:** Save to `.claude/docs/security/pentest-report-{date}.md` with severity counts, findings (file, evidence, attack vector, fix), tool recommendations.

## Severity Classification

| Severity | Criteria | Examples |
|----------|----------|---------|
| CRITICAL | RCE, auth bypass, data breach | SpEL injection, exposed actuator/heapdump, `enableDefaultTyping()` |
| HIGH | Privilege escalation, data exposure | Missing @PreAuthorize, IDOR, hardcoded secrets |
| MEDIUM | Defense-in-depth gap | CSRF disabled, missing @Valid, weak hashing |
| LOW | Best practice violation | Missing security headers, unscoped @RequestMapping |

## References

- **[Scan methodology](references/scan-methodology.md)** — OWASP Top 10 mapping table, Spring-critical vulnerability matrix, report template
- **[Attack patterns](references/attack-patterns.md)** — SpEL injection, Jackson deser, mass assignment, SecurityFilterChain, actuator chains
- **[Actuator exploitation](references/actuator-exploitation.md)** — RCE chains, data leak endpoints, secure configuration
- **[OWASP Top 10](references/owasp-top10.md)** — Detection commands, vulnerable vs secure code per category
- **[Spring CVEs](references/spring-cves.md)** — Real CVEs (2022-2026) with detection and mitigation

## Related Skills

- **spring-security** — SecurityFilterChain configuration, JWT validation, CORS
- **observability-patterns** — PII logging detection (A09), audit trail
- **testing-workflow** — Security test phase in verification pipeline