Panda's Blog
Menu
Published
Reading time1 min

Common Tricks for Auditing Spring Applications

SummaryFigure 1 uses MurphySec's JAR scanner to identify vulnerable components. Figures 2 and 3 cover unusual servlets and services worth checking in web.xml or xxxService.xml. Figure 4 is a shortcut for locating related classes, Figure 5 covers batch decompilation, and Figure 6 shows how to find route lists with keyword searches…

Java Code Auditing

Figure 1 uses MurphySec's JAR scanner to quickly identify JAR packages containing vulnerable components.

Figures 2 and 3 show why a quick audit should inspect unusual servlets or services declared in web.xml or an xxxService.xml file.
Figures 2 and 3 show why a quick audit should inspect unusual servlets or services declared in web.xml or an xxxService.xml file.
2.png
Figure 4 shows a routine shortcut for locating related classes during an audit.
Figure 4 shows a routine shortcut for locating related classes during an audit.
Figure 5 shows two methods for batch decompilation.
Figure 5 shows two methods for batch decompilation.
Figure 6 shows how to find a list of routes through keyword searches.
Figure 6 shows how to find a list of routes through keyword searches.
Figure 7 shows a plugin for quickly finding endpoints when the code can be compiled, as is usually the case for open-source projects.
Figure 7 shows a plugin for quickly finding endpoints when the code can be compiled, as is usually the case for open-source projects.
Figure 8 is a technique I learned from Skay: when debugging is possible, setting a breakpoint in this class can reveal route lists.
Figure 8 is a technique I learned from Skay: when debugging is possible, setting a breakpoint in this class can reveal route lists.
Figures 9 and 10 show a trick for bypassing authorization when suffixPatternMatch is TRUE.
Figures 9 and 10 show a trick for bypassing authorization when suffixPatternMatch is TRUE.
9.png
Figure 11 shows a trick for bypassing authorization when setUseTrailingSlashMatch is true.
Figure 11 shows a trick for bypassing authorization when setUseTrailingSlashMatch is true.
Figure 12 shows a Spring Security bypass scenario I learned from Sanmeng.
Figure 12 shows a Spring Security bypass scenario I learned from Sanmeng.
Figures 13 and 14 show several startsWith() and endsWith() authorization bypass techniques.
Figures 13 and 14 show several startsWith() and endsWith() authorization bypass techniques.
13.png
Figures 15 and 16 show a coding pattern that can bypass authorization when the destination of a forward is controllable.
Figures 15 and 16 show a coding pattern that can bypass authorization when the destination of a forward is controllable.
15.png
Figures 17 and 18 contain Shiro authorization-bypass tips collected by a researcher from Xianzhi.
Figures 17 and 18 contain Shiro authorization-bypass tips collected by a researcher from Xianzhi.
17.png
Figure 19 presents several approaches for projects that use JWT authorization.
Figure 19 presents several approaches for projects that use JWT authorization.
Figure 20 presents several ideas for fuzzing authorization bypasses.
Figure 20 presents several ideas for fuzzing authorization bypasses.
20.png