I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security.

Is there any kind of analysis on HTTP headers that can provide information about it?

  • If you can get the app to expose stack traces it should be pretty easy to spot spring security filters in the stack. – Affe Mar 19 '19 at 22:49

Welcome to Security.SE. :)

Yes, there are a few things you can do to find Spring Framework, or more specifically Spring Boot. Spring Security is a little more awkward, but you can look for /login and see what it does. Here's some things I do:

Aside from that, look at the HTML responses. Especially on /login. It has a boilerplate response.

  • Would this be considered a type of fingerprinting then? – Daisetsu Mar 20 '19 at 8:19
  • Yes. :) Just a question of where. Some applications have dead giveaways in response headers (X-Powered-By, for example), while others have standard CSS bundlers, like with Ruby on Rails framework. – h4ckNinja Mar 21 '19 at 6:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.