I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security.
Is there any kind of analysis on HTTP headers that can provide information about it?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Welcome to Security.SE. :)
Yes, there are a few things you can do to find Spring Framework, or more specifically Spring Boot. Spring Security is a little more awkward, but you can look for
/login and see what it does. Here's some things I do:
/health(https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html) or if using the newer Spring Actuator,
Aside from that, look at the HTML responses. Especially on
/login. It has a boilerplate response.