P4r4d1se/heapdump_shiro_vuln

A heapdump leads to Shiro key leaks causing a remote code execution (RCE) vulnerability environment.

Introduction

Overview

The heapdump_shiro_vuln repository provides a vulnerable environment that demonstrates how heapdump can leak the Shiro key leading to RCE vulnerabilities.

Key Features

Vulnerability Demonstration: The environment showcases a Shiro deserialization vulnerability that can be exploited if the Shiro key is obtained.
Docker Support: The project can be easily run using Docker, allowing for quick setup and testing in isolated environments.
Heapdump Access: Users can access the /actuator/heapdump endpoint to obtain the heapdump file and extract the Shiro key.
Version Compatibility: Demonstrates vulnerabilities specific to Shiro version 1.8.0.

Benefits

Educational Tool: Ideal for security researchers and developers to understand the risks associated with Shiro key leaks.
Hands-On Experience: Allows users to practice exploitation techniques in a controlled setting, enhancing security skillsets.