| name | pentest |
| description | Spring Boot security scanner — OWASP Top 10, SpEL injection, Actuator exploitation, Jackson deserialization, mass assignment, and Spring Security misconfiguration detection. Includes 6 automated scanning scripts and real CVE patterns. Use when performing security reviews, penetration testing, vulnerability assessments, security audits, or checking for known CVEs in Spring Boot projects. Run /pentest-scan for automated full-project scan.
|
| triggers | {"natural":["security scan","pentest","owasp","vulnerability","security review","security audit","cve check"],"code":["SecurityConfig","@PreAuthorize","CSRF","XSS","SQL injection","SpEL","Actuator"]} |
| applicability | {"always":false,"triggers":{"auto_fire":["/pentest-scan invocation","high-stakes lane security review"],"command":["/pentest-scan","/threat-model"],"task_keywords":["security","OWASP","pentest","vulnerability","CVE","threat model","SSRF","injection","auth bypass"],"related_rules":["rules/common/security.md","rules/java/security.md"]}} |
| relevance_assessment | HIGH 100%: /pentest-scan or /threat-model invoked OR security audit task
HIGH 80%+: high-stakes lane Review S2 stage
MEDIUM 40-79%: auth / crypto / input-validation code change
LOW 1-39%: tangential security touch (e.g., logging level for security event)
ZERO: pure refactor, no security boundary
|
Spring Boot Security Scanner
Authorization required. Confirm context: pentest engagement, defensive review, CTF, or research.
Automated Scripts
SKILL_DIR="${CLAUDE_PLUGIN_ROOT:-$(dirname "$0")/..}/skills/pentest"
bash "$SKILL_DIR/scripts/scan-runner.sh" src/main
bash "$SKILL_DIR/scripts/endpoint-mapper.sh" src/main
bash "$SKILL_DIR/scripts/secrets-scanner.sh" .
bash "$SKILL_DIR/scripts/injection-scanner.sh" src/main
bash "$SKILL_DIR/scripts/security-config-audit.sh" .
bash "$SKILL_DIR/scripts/dependency-checker.sh" .
4-Phase Scan Methodology
Phase 1 — Reconnaissance: endpoint-mapper.sh + security-config-audit.sh. Read project-profile.json. Identify auth mechanism (JWT, session, OAuth2).
Phase 2 — OWASP Top 10 + Spring-Specific: A01–A10 with Spring risks (SpEL injection, Actuator exposure, Jackson deser). See references/scan-methodology.md for mapping table + vulnerability matrix.
Phase 3 — Spring-Critical Deep-Dive: RCE vectors: SpEL injection, Actuator chains, Jackson enableDefaultTyping(), mass assignment, SecurityFilterChain ordering. See references/attack-patterns.md.
Phase 4 — Report: Save to .claude/docs/security/pentest-report-{date}.md with severity counts, findings (file, evidence, attack vector, fix), tool recommendations.
Severity Classification
| Severity | Criteria | Examples |
|---|
| CRITICAL | RCE, auth bypass, data breach | SpEL injection, exposed actuator/heapdump, enableDefaultTyping() |
| HIGH | Privilege escalation, data exposure | Missing @PreAuthorize, IDOR, hardcoded secrets |
| MEDIUM | Defense-in-depth gap | CSRF disabled, missing @Valid, weak hashing |
| LOW | Best practice violation | Missing security headers, unscoped @RequestMapping |
References
- Scan methodology — OWASP Top 10 mapping table, Spring-critical vulnerability matrix, report template
- Attack patterns — SpEL injection, Jackson deser, mass assignment, SecurityFilterChain, actuator chains
- Actuator exploitation — RCE chains, data leak endpoints, secure configuration
- OWASP Top 10 — Detection commands, vulnerable vs secure code per category
- Spring CVEs — Real CVEs (2022-2026) with detection and mitigation
Related Skills
- spring-security — SecurityFilterChain configuration, JWT validation, CORS
- observability-patterns — PII logging detection (A09), audit trail
- testing-workflow — Security test phase in verification pipeline
