org:YOUR_TARGET http.favicon.hash:116323821
Use this query on Shodan to find Spring Boot servers. Then check for exposed actuators. If /env is available you can probably achieve RCE. If /heapdump is accessible you may find private keys and tokens. #bugbountytips
Use this query on Shodan to find Spring Boot servers. Then check for exposed actuators. If /env is available you can probably achieve RCE. If /heapdump is accessible you may find private keys and tokens. #bugbountytips
Also, if you find /jolokia you may be able to achieve a RCE as well github.com/ba0zi/Spring-B…
To explore the .hprof file that you can download if you have access to /heapdump, you can use VisualVM (standalone tool) or Eclipse
