tpt11fb/springvulscanburpsuite 的Spring漏洞扫描插件。SpringVulScan：支持检测：路由泄露|CVE-2022-22965|CVE-2022-22963|CVE-2022-22947|CVE-2016-4977
This is the first Burp Suite plugin I developed. The goal was to better and more conveniently detect potential Spring vulnerabilities. Developing it for the first time, I encountered many problems and difficulties. From gathering online resources about Burp Suite plugin development (API, documentation) to now having basic functionality implemented, it took about half a month (with some other distractions in between). But fortunately, I have now completed it! I plan to create a guide on Burp Suite plugin development (API usage) when I have time, and I will also upload the documentation to GitHub. I will continue to maintain it in the future when I have time! Below is an introduction to its features and usage.
Interface
The appearance is just so-so; the GUI took some effort.
File Directory
conifg
------apiRoute.txt Route leakage detection, customizable.
------config.yml CVE vulnerability detection payload. It is not recommended to customize some payloads.
SpringVulScan-1.0.jar
Detection Results
This panel is not very convenient, so it was added to the dashboard. Therefore, you can directly check the dashboard to see if there are vulnerabilities.
For vulnerabilities like CVE-2022-22965 that can be directly exploited and are easy to detect, they are reported as high-risk red. For things like API leakage, which are not easy to detect, they are placed in the Low and Medium panels. Of course, the Medium panel has a higher probability than the Low panel and is more accurate.
That's all for the basic points and usage. As this is my first tool, there are bound to be unknown issues. Please submit an issue directly.
https://portswigger.net/burp/extender/api/burp/package-summary.html
And some other open-source plugins.
| Feature | Description |
|---|
| Basic Settings | Nothing to say. |
| Detection Method | Echo and callback, nothing to say. Under normal circumstances, just enable all. |
| Scan Type | Single site detection only once: Enabled by default. After enabling, only one detection is performed per site, and it will not re-detect due to URL changes. Filter detection of Spring framework: Disabled by default. After enabling, it automatically filters detection based on the Spring feature 'whitelabel error page', and will not scan other traffic again. |
| CVE Detection | Specify vulnerability types to detect. |
| Callback Platform | Currently only supports Burp Collaborator and DnsLog.cn. Other platforms are not yet fully functional. If the target does not have traffic restrictions, using Burp Collaborator is recommended for fast scanning and accurate results. |