P4r4d1se/heapdump_shiro_vuln

Overview

The heapdump_shiro_vuln repository provides a vulnerable environment that demonstrates how heapdump can leak the Shiro key leading to RCE vulnerabilities.

Key Features

• Vulnerability Demonstration: The environment showcases a Shiro deserialization vulnerability that can be exploited if the Shiro key is obtained.
• Docker Support: The project can be easily run using Docker, allowing for quick setup and testing in isolated environments.
• Heapdump Access: Users can access the /actuator/heapdump endpoint to obtain the heapdump file and extract the Shiro key.
• Version Compatibility: Demonstrates vulnerabilities specific to Shiro version 1.8.0.

Benefits

• Educational Tool: Ideal for security researchers and developers to understand the risks associated with Shiro key leaks.
• Hands-On Experience: Allows users to practice exploitation techniques in a controlled setting, enhancing security skillsets.

Highlights

• The repository is actively maintained and updated for usability and improved functionality.