{"id":3723,"date":"2023-09-16T13:46:56","date_gmt":"2023-09-16T11:46:56","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=3723"},"modified":"2024-09-17T14:04:27","modified_gmt":"2024-09-17T12:04:27","slug":"spring-boot","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=3723","title":{"rendered":"Spring Boot"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Mandatory<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Deter\u00admine if there are Spring Boot default end\u00adpoints<br><code>python3 \/opt\/dirsearch\/dirsearch.py -u http:\/\/cozyhosting.htb\/ --random-agent -e html,sql,txt,bak,conf,inc -w \/usr\/share\/seclists\/Discovery\/Web-Content\/spring-boot.txt -r<\/code><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Optional<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use this script to list all end\u00adpoints for fur\u00adther research:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"ruby\" data-enlighter-theme data-enlighter-highlight data-enlighter-linenumbers data-enlighter-lineoffset data-enlighter-title data-enlighter-group>require 'find'\n\n# Define the annotations to search for\nANNOTATIONS = {\n  'RequestMapping' =&gt; :any,\n  'GetMapping'     =&gt; 'GET',\n  'PostMapping'    =&gt; 'POST',\n  'PutMapping'     =&gt; 'PUT',\n  'DeleteMapping'  =&gt; 'DELETE'\n}\n\n# Regex to match the method annotations and their paths\nANNOTATION_REGEX = \/@(RequestMapping|GetMapping|PostMapping|PutMapping|DeleteMapping)\\(([^)]*)\\)\/\n\n# Directory where the Java source files are located\nSOURCE_DIR = 'src\/main\/java\/'\n\ndef extract_endpoints_from_file(file)\n  endpoints = []\n  \n  File.foreach(file).with_index do |line, line_num|\n    if line.match(ANNOTATION_REGEX)\n      annotation, params = line.match(ANNOTATION_REGEX).captures\n      http_method = ANNOTATIONS[annotation]\n\n      # Extract path from annotation parameters\n      path = params.match(\/\"([^\"]*)\"\/) ? params.match(\/\"([^\"]*)\"\/)[1] : '\/'\n      endpoints &lt;&lt; { method: http_method, path: path, file: file, line: line_num + 1 }\n    end\n  end\n  \n  endpoints\nend\n\ndef scan_project_for_endpoints\n  all_endpoints = []\n  \n  # Recursively find all .java files in the source directory\n  Find.find(SOURCE_DIR) do |path|\n    if path =~ \/.*\\.java$\/\n      all_endpoints.concat(extract_endpoints_from_file(path))\n    end\n  end\n  \n  all_endpoints\nend\n\n# Run the scan and output the results\nendpoints = scan_project_for_endpoints\n\nif endpoints.empty?\n  puts \"No endpoints found.\"\nelse\n  puts \"Endpoints found:\"\n  endpoints.each do |endpoint|\n    puts \"#{endpoint[:method]} #{endpoint[:path]} (in #{endpoint[:file]} at line #{endpoint[:line]})\"\n  end\nend\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Manda\u00adto\u00adry Option\u00adal Use this script to list all end\u00adpoints for fur\u00adther research:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470],"tags":[268,463],"class_list":["post-3723","post","type-post","status-publish","format-standard","hentry","category-active-enum","tag-java","tag-spring-boot"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3723"}],"version-history":[{"count":2,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3723\/revisions"}],"predecessor-version":[{"id":4448,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3723\/revisions\/4448"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3723"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3723"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}