Spring Boot Dump Scanner

Spring Boot Dump Scanner provides a scan check to automatically detect exposed actuator endpoints that can leak sensitive application data. The extension identifies publicly accessible heapdump and threaddump endpoints that expose memory dumps and thread states, helping security professionals find critical information disclosure vulnerabilities in Spring Boot applications.

Features

• Comprehensive endpoint discovery for /heapdump and /threaddump paths
• Multiple path variant detection including /manage/, /admin/, /debug/, /monitor/, /system/, and /internal/ prefixes
• Smart response validation to reduce false positives by checking content types and headers

Usage

1. This extension integrates with Burp Scanner as an active scan check
2. Perform active scans on Spring Boot applications or right-click targets and select "Scan". Ensure that your scan configuration includes "Extension-generated issues"
3. Review identified issues in the Issues tab of your scan task for exposed dump endpoints