Detecting Debug Endpoints

Overview

Modern web stacks ship rich introspection by default. Spring Boot

Actuator exposes /actuator/env (every environment variable),

/actuator/heapdump (a live heap snapshot that contains credentials),

/actuator/jolokia (JMX bean invocation = pre-auth RCE in some

configurations). Apache mod_status exposes /server-status with

internal IPs, request counts, and the URL of every active request.

Prometheus /metrics exposes operational telemetry that often

includes connection-string-bearing labels by accident. phpMyAdmin

exposes the entire database if unauthenticated.

These are not bugs in the frameworks. They're features that ship

enabled-by-default for development convenience and stay enabled in

production because nobody disabled them at install time. The probe

set covers the canonical 40+ paths and grades each by the response

fingerprint specific to that framework.

When the skill produces findings

Prerequisites

• Python 3.9+ with requests
• Authorization for non-local targets

Instructions

Step 1 — Confirm Authorization

"Do you have authorization to perform admin / debug endpoint
 discovery on this target? I need confirmation before proceeding."

Step 2 — Run the scanner

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-debug-endpoints/scripts/probe_debug.py \
    https://target.example.com \
    --authorized

Options:

Usage: probe_debug.py URL [OPTIONS]

Options:
  --authorized       Attest authorization (required for non-local)
  --output FILE      Write findings to FILE
  --format FMT       json | jsonl | markdown (default: markdown)
  --min-severity SEV (default: info)
  --timeout SECS     Per-probe timeout (default: 10)
  --paths-file FILE  Override the default probe set with a custom list
  --include-redirects  Treat 302/303 to /login as findings (debug panel
                       exists but auth gates it — still worth noting)

The scanner sends a GET for each path. For 200 responses, it inspects

the body for the framework-specific fingerprint to confirm a true

positive (not the app's SPA index page). For 302 responses to common

login paths, the panel exists but auth is in front — flagged only

with --include-redirects.

Step 3 — Interpret findings

CRITICAL = direct compromise vector (env vars / heapdump / Jolokia /

phpMyAdmin). Ship same-hour fix: take the endpoint behind authn or

disable it. Audit for prior exploitation.

HIGH = information disclosure substantial enough to drive subsequent

attacks (server-status reveals request URLs including session tokens

in query strings; /metrics labels often contain connection strings;

/admin reachable means brute-force can start).

MEDIUM = posture hardening (health checks, swagger).

Step 4 — Cross-skill chaining

After this skill, suggest:

• detecting-exposed-secrets-files (#6) — same deploy mistake. If

/server-status is reachable, .git/ often is too.

• auditing-cors-policy (#3) — if a GraphQL or admin endpoint is

reachable AND has open CORS, the attack chain compounds.

Examples

Example 1 — Inheriting a system audit

User: "We just acquired example.io. Quick audit of admin surface."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-debug-endpoints/scripts/probe_debug.py \
    https://example.io --authorized --min-severity medium

Commonly surfaces forgotten /server-status on Apache hosts,

/actuator/* left enabled from Spring Boot defaults, leftover

/phpmyadmin from initial install.

Example 2 — Spring Boot Actuator paranoia sweep

User: "We use Spring Boot heavily. Show me everywhere Actuator is

reachable."

for ENDPOINT in $(cat spring-services.txt); do
  python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-debug-endpoints/scripts/probe_debug.py \
      "$ENDPOINT" --authorized --format jsonl
done | jq 'select(.title | contains("Actuator"))'

Example 3 — CI gate against accidental re-enablement

- name: Debug-endpoint guard
  run: |
    python3 plugins/security/penetration-tester/skills/detecting-debug-endpoints/scripts/probe_debug.py \
        "${{ secrets.STAGING_URL }}" \
        --authorized --min-severity high

Exit 1 fails the deploy if any HIGH or CRITICAL endpoint exposure

appears. Catches the regression where a debug profile gets enabled

in a application-prod.yml by accident.

Output

JSON / JSONL / Markdown per lib/report.py. Exit codes: 0 clean, 1

high/critical, 2 error.

Error Handling

• SPA catches every URL with 200 → use --check-only semantics

(default: fingerprint check filters out SPA matches).

• WAF / CDN blocks the scanner → expected for some targets.

Coordinate with the target's security team for an allowlist; or

run the scanner from inside the target's network if you have

authorized internal access.

• Connection error → exit 2 with underlying error.

Resources

• references/THEORY.md — Per-framework reasoning: why Actuator,

mod_status, Prometheus, GraphQL Playground, Swagger, phpMyAdmin

each matter; canonical fingerprints

• references/PLAYBOOK.md — Per-framework remediation: Spring Boot

Actuator authn, Apache mod_status deny, Prometheus

Bearer-token, GraphQL introspection toggle, Swagger profile gate

• ../analyzing-tls-config/references/AUTHORIZATION.md — Active-scan

authorization pattern