# aabysszg/springboot-scan architecture

> Architecture diagram of the GitHub repository aabysszg/springboot-scan, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aabysszg/springboot-scan
- Repository: https://github.com/aabysszg/springboot-scan

## Overview

SpringBoot-Scan is a command-line Spring reconnaissance and penetration-testing framework. Its main workflow accepts a target, validates and fingerprints it, then scans for exposed endpoints, downloads sensitive files, or tests a selected vulnerability; URL-list modes provide batch scanning. Separate workflows query ZoomEye, FOFA, and Hunter for Spring assets. The sampled sources establish the CLI dispatch, proxy/header setup, and representative scan and exploit behavior. The README documents additional vulnerability coverage; those families share the sampled vulnerability modules, whose unsampled internals are not mapped individually.

Main entry points: [`inc/console.py`](https://github.com/aabysszg/springboot-scan/blob/main/inc/console.py) (Mode dispatcher), [`inc/run.py`](https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py) (Endpoint disclosure scan), [`inc/poc.py`](https://github.com/aabysszg/springboot-scan/blob/main/inc/poc.py) (Batch vulnerability checks), [`inc/zoom.py`](https://github.com/aabysszg/springboot-scan/blob/main/inc/zoom.py) (ZoomEye search)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI and request setup"]
  node_cli["CLI entry<br/>[SpringBoot-Scan.py]"]
  node_setup["Proxy and headers<br/>[proxycheck.py]"]
  node_dispatch["Mode dispatcher<br/>[console.py]"]
end

subgraph group_scan["Target reconnaissance"]
  node_fingerprint["Normalize and fingerprint<br/>[springcheck.py]"]
  node_endpoint["Endpoint disclosure scan<br/>[run.py]"]
  node_download["Sensitive file download<br/>[run.py]"]
  node_batchscan["Batch disclosure scan<br/>[run.py]"]
  node_batchdump["Batch file scan<br/>[run.py]"]
end

subgraph group_vuln["Vulnerability testing"]
  node_exploit["Interactive exploit tests<br/>[vul.py]"]
  node_poc["Batch vulnerability checks<br/>[poc.py]"]
end

subgraph group_assets["Asset discovery"]
  node_zoomeye["ZoomEye search<br/>[zoom.py]"]
  node_fofa["FOFA search<br/>[fofa.py]"]
  node_hunter["Hunter search<br/>[hunter.py]"]
end

node_operator(("Operator"))
node_target(("Spring target"))
node_assetapis(("Asset search APIs"))
node_resultfiles["Scan result files"]
node_sensitivefiles["Downloaded files"]

node_operator -->|"selects mode"| node_cli
node_cli -->|"passes options"| node_setup
node_setup -->|"dispatches configured run"| node_dispatch
node_dispatch -->|"validates target"| node_fingerprint
node_fingerprint -->|"probes"| node_target
node_dispatch -->|"runs single scan"| node_endpoint
node_dispatch -->|"runs batch scan"| node_batchscan
node_dispatch -->|"starts download scan"| node_download
node_dispatch -->|"starts batch dump scan"| node_batchdump
node_dispatch -->|"starts exploit tests"| node_exploit
node_dispatch -->|"starts batch checks"| node_poc
node_dispatch -.->|"starts asset search"| node_zoomeye
node_dispatch -.->|"starts asset search"| node_fofa
node_dispatch -.->|"starts asset search"| node_hunter
node_endpoint -->|"requests endpoints"| node_target
node_batchscan -->|"requests targets"| node_target
node_download -->|"fetches files"| node_target
node_batchdump -->|"checks targets"| node_target
node_exploit -->|"sends exploit requests"| node_target
node_poc -->|"tests vulnerabilities"| node_target
node_endpoint -->|"writes findings"| node_resultfiles
node_batchscan -->|"writes findings"| node_resultfiles
node_batchdump -->|"exports URLs"| node_resultfiles
node_poc -->|"writes findings"| node_resultfiles
node_download -->|"downloads matches"| node_sensitivefiles
node_zoomeye -.->|"queries"| node_assetapis
node_fofa -.->|"queries"| node_assetapis
node_hunter -.->|"queries"| node_assetapis
node_zoomeye -->|"exports assets"| node_resultfiles
node_fofa -->|"exports assets"| node_resultfiles
node_hunter -->|"exports assets"| node_resultfiles

click node_cli "https://github.com/aabysszg/springboot-scan/blob/main/SpringBoot-Scan.py"
click node_setup "https://github.com/aabysszg/springboot-scan/blob/main/inc/proxycheck.py"
click node_dispatch "https://github.com/aabysszg/springboot-scan/blob/main/inc/console.py"
click node_fingerprint "https://github.com/aabysszg/springboot-scan/blob/main/inc/springcheck.py"
click node_endpoint "https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py"
click node_download "https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py"
click node_batchscan "https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py"
click node_batchdump "https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py"
click node_exploit "https://github.com/aabysszg/springboot-scan/blob/main/inc/vul.py"
click node_poc "https://github.com/aabysszg/springboot-scan/blob/main/inc/poc.py"
click node_zoomeye "https://github.com/aabysszg/springboot-scan/blob/main/inc/zoom.py"
click node_fofa "https://github.com/aabysszg/springboot-scan/blob/main/inc/fofa.py"
click node_hunter "https://github.com/aabysszg/springboot-scan/blob/main/inc/hunter.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_setup,node_dispatch toneBlue
class node_fingerprint,node_endpoint,node_download,node_batchscan,node_batchdump toneAmber
class node_exploit,node_poc,node_assetapis toneMint
class node_zoomeye,node_fofa,node_hunter toneRose
class node_operator,node_target,node_resultfiles,node_sensitivefiles toneIndigo
```

## Components

### CLI and request setup

- [CLI entry](https://github.com/aabysszg/springboot-scan/blob/main/SpringBoot-Scan.py): `SpringBoot-Scan.py`
- [Proxy and headers](https://github.com/aabysszg/springboot-scan/blob/main/inc/proxycheck.py): `inc/proxycheck.py`
- [Mode dispatcher](https://github.com/aabysszg/springboot-scan/blob/main/inc/console.py): `inc/console.py`

### Target reconnaissance

- [Normalize and fingerprint](https://github.com/aabysszg/springboot-scan/blob/main/inc/springcheck.py): `inc/springcheck.py`
- [Endpoint disclosure scan](https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py): `inc/run.py`
- [Sensitive file download](https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py): `inc/run.py`
- [Batch disclosure scan](https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py): `inc/run.py`
- [Batch file scan](https://github.com/aabysszg/springboot-scan/blob/main/inc/run.py): `inc/run.py`

### Vulnerability testing

- [Interactive exploit tests](https://github.com/aabysszg/springboot-scan/blob/main/inc/vul.py): `inc/vul.py`
- [Batch vulnerability checks](https://github.com/aabysszg/springboot-scan/blob/main/inc/poc.py): `inc/poc.py`

### Asset discovery

- [ZoomEye search](https://github.com/aabysszg/springboot-scan/blob/main/inc/zoom.py): `inc/zoom.py`
- [FOFA search](https://github.com/aabysszg/springboot-scan/blob/main/inc/fofa.py): `inc/fofa.py`
- [Hunter search](https://github.com/aabysszg/springboot-scan/blob/main/inc/hunter.py): `inc/hunter.py`

### Other components

- **Operator**
- **Spring target**
- **Asset search APIs**
- **Scan result files**
- **Downloaded files**

## Connections

- Operator → CLI entry: selects mode
- CLI entry → Proxy and headers: passes options
- Proxy and headers → Mode dispatcher: dispatches configured run
- Mode dispatcher → Normalize and fingerprint: validates target
- Normalize and fingerprint → Spring target: probes
- Mode dispatcher → Endpoint disclosure scan: runs single scan
- Mode dispatcher → Batch disclosure scan: runs batch scan
- Mode dispatcher → Sensitive file download: starts download scan
- Mode dispatcher → Batch file scan: starts batch dump scan
- Mode dispatcher → Interactive exploit tests: starts exploit tests
- Mode dispatcher → Batch vulnerability checks: starts batch checks
- Mode dispatcher → ZoomEye search: starts asset search
- Mode dispatcher → FOFA search: starts asset search
- Mode dispatcher → Hunter search: starts asset search
- Endpoint disclosure scan → Spring target: requests endpoints
- Batch disclosure scan → Spring target: requests targets
- Sensitive file download → Spring target: fetches files
- Batch file scan → Spring target: checks targets
- Interactive exploit tests → Spring target: sends exploit requests
- Batch vulnerability checks → Spring target: tests vulnerabilities
- Endpoint disclosure scan → Scan result files: writes findings
- Batch disclosure scan → Scan result files: writes findings
- Batch file scan → Scan result files: exports URLs
- Batch vulnerability checks → Scan result files: writes findings
- Sensitive file download → Downloaded files: downloads matches
- ZoomEye search → Asset search APIs: queries
- FOFA search → Asset search APIs: queries
- Hunter search → Asset search APIs: queries
- ZoomEye search → Scan result files: exports assets
- FOFA search → Scan result files: exports assets
- Hunter search → Scan result files: exports assets