Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/detecting-debug-endpoints
Probe a target for accidentally-public admin / debug / introspection endpoints — Spring Boot Actuator, Apache server-status, Prometheus metrics, GraphQL playground, Swagger UI, phpMyAdmin, JMX-over-HTTP (Jolokia), Elasticsearch _cat, Kibana / Grafana / Eureka / Consul panels.
Passed 19 of 21 test cases with the skill, and 10 of 21 without it.
and 8 more in the full report
10 fixed10 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
We want to test a custom list of internal URI paths against our application using the debug probing tool instead of using the built-in path set. Which command line option accepts an external path list file?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies the --paths-file flag | Missed | Passed |
The instructions your model reads when the skill loads.
Modern web stacks ship rich introspection by default. Spring Boot
Actuator exposes /actuator/env (every environment variable),
/actuator/heapdump (a live heap snapshot that contains credentials),
/actuator/jolokia (JMX bean invocation = pre-auth RCE in some
configurations). Apache mod_status exposes /server-status with
internal IPs, request counts, and the URL of every active request.
Prometheus /metrics exposes operational telemetry that often
includes connection-string-bearing labels by accident. phpMyAdmin
exposes the entire database if unauthenticated.
These are not bugs in the frameworks. They're features that ship enabled-by-default for development convenience and stay enabled in production because nobody disabled them at install time. The probe set covers the canonical 40+ paths and grades each by the response fingerprint specific to that framework.
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
Spring Boot Actuator /env exposed | CRITICAL | 200 + body has "propertySources" | OWASP A05:2021 |
Spring Boot Actuator /heapdump exposed | CRITICAL | 200 + Content-Type: application/octet-stream + multi-MB body | CWE-200 |
Spring Boot Actuator /jolokia exposed | CRITICAL | 200 + body has "agent":"jolokia" | CWE-749 |
| phpMyAdmin reachable | CRITICAL | 200 + HTML body contains "phpMyAdmin" + login form | OWASP A07:2021 |
Prometheus /metrics exposed | HIGH | 200 + body has # HELP or # TYPE lines | CWE-200 |
Apache mod_status exposed | HIGH | 200 + body contains "Apache Server Status" | CWE-200 |
Spring Boot Actuator /actuator index | HIGH | 200 + body has "_links" JSON | OWASP A05:2021 |
Generic /admin returning 200 (not 401/403) | HIGH | 200 + HTML body with admin-shaped UI | CWE-285 |
Elasticsearch _cat exposed | HIGH | 200 + body matches health\s+status\s+index | CWE-200 |
| GraphQL Playground on prod | MEDIUM | 200 + body contains "GraphQLPlayground" | CWE-200 |
| Swagger UI on prod | MEDIUM | 200 + body contains "swagger-ui" | CWE-200 |
Spring Boot Actuator /health exposed | MEDIUM | 200 + body has "status":"UP" | CWE-200 |
phpinfo page on prod | MEDIUM | 200 + body has PHP Version heading | CWE-200 |
/robots.txt discloses admin paths | LOW | 200 + Disallow: lines mentioning /admin | CWE-200 |
test cases passed, vs 10 / 21 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.