sbe-scan

sbe-scan 是一个用Go语言编写的 SpringBoot ENV 利用工具，可以用来获取 SpringBoot 应用的配置信息，包括配置文件中的配置项、环境变量、JVM参数等。

安装

sbe-scan 需要go 1.21才能完成安装 执行以下命令

go install github.com/wjlin0/sbe-scan/cmd/sbe-scan@latest

或者 安装完成的二进制文件在release中下载

wget https://github.com/wjlin0/sbe-scan/releases/download/v0.0.2/

使用

sbe-scan -help

sbe-scan is a tool to scan spring boot env.

Usage:
  sbe-scan [flags]

Flags:
INPUT:
   -url, -u string[]  URL to scan
   -list string[]     File containing list of URLs to scan

CONFIG:
   -eu, -env-url string[]            URL to get env
   -ju, -jolokia-url string[]        URL to get jolokia
   -jlu, -jolokia-list-url string[]  URL to get jolokia list
   -en, -env-name string[]           env name to get env
   -m, -method string[]              method to get env (support methods one)
   -header string[]                  Headers to use for enumeration

LIMIT:
   -t, -thread int       Number of concurrent threads (default 10) (default 10)
   -rl, -rate-limit int  Rate limit for enumeration speed (n req/sec)

DEBUG:
   -debug  Enable debugging

UPDATE:
   -update  Update tool


Examples:
Run sbe-scan on a single targets
        $ sbe-scan -url https://example.com
Run sbe-scan on a list of targets
        $ sbe-scan -list list.txt
Run sbe-scan on a single targets with env-url
        $ sbe-scan -url https://example.com -eu /actuator/env
Run sbe-scan on a single targets with env-name
        $ sbe-scan -url https://example.com -en spring.datasource.password
Run sbe-scan on a single targets a proxy server
        $ export https_proxy='http://127.0.0.1:7890' sbe-scan -url https://example.com 
        

use pathScan to collect targets and pass them to sbe-scan via standard input

pathScan -ue quake -uq 'app:"springboot"' -uc -silent -ul 200 | sbe-scan
```text