How aabysszg/springboot-scan works
SpringBoot-Scan is a command-line Spring reconnaissance and penetration-testing framework. Its main workflow accepts a target, validates and fingerprints it, then scans for exposed endpoints, downloads sensitive files, or tests a selected vulnerability; URL-list modes provide batch scanning. Separate workflows query ZoomEye, FOFA, and Hunter for Spring assets. The sampled sources establish the CLI dispatch, proxy/header setup, and representative scan and exploit behavior. The README documents additional vulnerability coverage; those families share the sampled vulnerability modules, whose unsampled internals are not mapped individually.
Main entry points: console.py Mode dispatcher · run.py Endpoint disclosure scan · poc.py Batch vulnerability checks · zoom.py ZoomEye search
Components 18
CLI and request setup
- CLI entry
SpringBoot-Scan.py - Proxy and headers
inc/proxycheck.py - Mode dispatcher
inc/console.py
Target reconnaissance
- Normalize and fingerprint
inc/springcheck.py - Endpoint disclosure scan
inc/run.py - Sensitive file download
inc/run.py - Batch disclosure scan
inc/run.py - Batch file scan
inc/run.py
Vulnerability testing
- Interactive exploit tests
inc/vul.py - Batch vulnerability checks
inc/poc.py
Asset discovery
- ZoomEye search
inc/zoom.py - FOFA search
inc/fofa.py - Hunter search
inc/hunter.py
Other components
- Operator
- Spring target
- Asset search APIs
- Scan result files
- Downloaded files
Connections 31
- Operator → CLI entry: selects mode
- CLI entry → Proxy and headers: passes options
- Proxy and headers → Mode dispatcher: dispatches configured run
- Mode dispatcher → Normalize and fingerprint: validates target
- Normalize and fingerprint → Spring target: probes
- Mode dispatcher → Endpoint disclosure scan: runs single scan
- Mode dispatcher → Batch disclosure scan: runs batch scan
- Mode dispatcher → Sensitive file download: starts download scan
- Mode dispatcher → Batch file scan: starts batch dump scan
- Mode dispatcher → Interactive exploit tests: starts exploit tests
- Mode dispatcher → Batch vulnerability checks: starts batch checks
- Mode dispatcher → ZoomEye search: starts asset search
- Mode dispatcher → FOFA search: starts asset search
- Mode dispatcher → Hunter search: starts asset search
- Endpoint disclosure scan → Spring target: requests endpoints
- Batch disclosure scan → Spring target: requests targets
- Sensitive file download → Spring target: fetches files
- Batch file scan → Spring target: checks targets
- Interactive exploit tests → Spring target: sends exploit requests
- Batch vulnerability checks → Spring target: tests vulnerabilities
- Endpoint disclosure scan → Scan result files: writes findings
- Batch disclosure scan → Scan result files: writes findings
- Batch file scan → Scan result files: exports URLs
- Batch vulnerability checks → Scan result files: writes findings
- Sensitive file download → Downloaded files: downloads matches
- ZoomEye search → Asset search APIs: queries
- FOFA search → Asset search APIs: queries
- Hunter search → Asset search APIs: queries
- ZoomEye search → Scan result files: exports assets
- FOFA search → Scan result files: exports assets
- Hunter search → Scan result files: exports assets