Ankur Mhatre
4b6cefa60a
Companion repository for the ankurm.com article. Every transcript in docs/output/ was produced by running this project; scripts/run-all.sh regenerates all of them. Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 / Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
14 lines
698 B
Plaintext
14 lines
698 B
Plaintext
### profiles: exposeall,open PLUS --management.endpoint.heapdump.access=unrestricted
|
|
|
|
$ curl -s -o /tmp/heap.hprof -w 'status=%{http_code} bytes=%{size_download} type=%{content_type}' http://localhost:8080/actuator/heapdump
|
|
status=200 bytes=59186852 type=application/octet-stream
|
|
|
|
$ strings /tmp/heap.hprof | grep -c 'S3CRET-partner-credential'
|
|
1
|
|
$ strings /tmp/heap.hprof | grep -o 'not-a-real-password[^"]*' | head -1
|
|
not-a-real-password-but-watch-what-/actuator/env-does-with-it!
|
|
|
|
/actuator/env masked both of these to ******.
|
|
/actuator/heapdump handed over the process memory that contains them in plaintext.
|
|
Sanitisation is a property-rendering feature. It is not a security boundary.
|