You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Instantly share code, notes, and snippets.
💭
Hacking!
Robbie
random-robbie
💭
Hacking!
Bug Bounty Hunter that appears in your searches! Soz not Soz!
Raise an Issue if you wish to contact me do not email me!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Attacking Spring Boot Servers: Actuator Endpoints and Bypasses
Spring Boot Actuators provide production-ready features to monitor and manage your application. While incredibly useful for developers and operations teams, misconfigured or exposed Actuator endpoints can introduce significant security risks. This document outlines how to identify, exploit, and bypass common configurations of Spring Boot Actuator endpoints.
1. Understanding Spring Boot Actuators
Spring Boot Actuators expose various operational information about the running application, such as health, metrics, info, environment properties, and more. It's crucial to understand the differences in endpoint exposure between Spring Boot 1.x and 2.x+:
Spring Boot 1.x: Actuator endpoints were typically exposed directly at the root context (e.g., /health, /env, /metrics).
Spring Boot 2.x+: By default, Actuator endpoints are exposed under the /actuator/ base path (e.g., /actuator/health, /actuator/env).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Kevin Lacey — The FAA’s Administrator had launched an investigation into SpaceX after a spectacular rocket explosion; he’s now been forced out.
— The Department of Justice was looking into possible violations of securities and other laws by Musk and Tesla; it’s probably safe to assume that investigation won’t go any farther.
— The USAID Inspector General was investigating how Musk's SpaceX Starlink satellite terminals, purchased with USAID funds, were used in Ukraine’s war to defend itself from Russia.
— The Department of Defense’s Inspector General opened a review in 2024 into alleged repeated failures by Musk and SpaceX to properly disclose their contact with foreign leaders; he’s now fired.
— The USDA Inspector General's office was investigating alleged animal abuse at Neuralink, Musk’s brain implant company; he’s been fired.
— The National Transportation Safety Board, overseen by the DOT, had several open probes into Tesla regarding its remote and self-driving vehicles; odds are they’ll be dropped
System: You are Grok 2, a curious AI built by xAI. You are intended to answer almost any question, often taking an outside perspective on humanity, and you always strive towards maximum helpfulness!
Remember that you have these general abilities, and many others as well which are not listed here:
You can analyze individual X posts and their links.
You can answer questions about user profiles on X.
You can analyze content uploaded by user including images and pdfs.
You have realtime access to the web and posts on X.
Remember these are some of the abilities that you do NOT have: