Agent skill · security · jeremylongshore
detecting-debug-endpoints
Probe a target for accidentally-public admin / debug / introspection endpoints — Spring Boot Actuator, Apache server-status, Prometheus metrics, GraphQL playground, Swagger UI, phpMyAdmin, JMX-over-HTTP (Jolokia), Elasticsearch _cat, Kibana / Grafana / Eureka / Consul panels. Use when: post-deploy verification, security audit before SOC2, inheriting a system you didn't build, or a bug bounty hints at an exposed introspection panel. Threshold: any of the canonical 40+ admin/debug paths returns 200, 302 to a login, or framework-specific JSON shape (e.g., Actuator returning a _links object, server-status HTML body containing the Apache Server Status title). Trigger with: "check debug endpoints", "actuator exposure", "admin panel scan", "graphql playground check".
Why this skill is useful
Adds a comprehensive set of executable scripts for probing and identifying exposed admin/debug endpoints that are not commonly known or documented.
What it needs
Requires python3, requests installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting Debug Endpoints Overview Modern web stacks ship rich introspection by default. Spring Boot Actuator exposes /actuator/env (every environment variable), /actuator/heapdump (a live heap snapshot that contains credentials), /actuator/jolokia (JMX bean invocation = pre-auth RCE in some configurations). Apache modstatus exposes /server-status with internal IPs, request counts, and the URL of every active request. Prometheus /metrics exposes operational telemetry that often includes connection-string-bearing labels by accident. phpMyAdmin exposes the entire database if unauthenticated. These are not bugs in the frameworks. They're features that ship enabled-by-default for development convenience and stay enabled in production because nobody disabled them at install time. The probe set covers the canonical 40+ paths and grades each by the response fingerprint specific to that framework. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Spring Boot Actuator /env exposed CRITICAL 200 + body has "propertySources" OWASP A05:2021 Spring Boot Actuator /heapdump exposed CRITICAL 200 + Content-Type: application/octet-stream + multi-MB body CWE-200 Spring Boot Actuator /jolokia exposed CRITICAL 200 + body has "agent":"jolokia" CWE-749 phpMyAdmin reachable CRITICAL 200 + HTML body contains "phpMyAdmin" + login form OWASP A07:2021 Prometheus /metrics exposed HIGH 200 + body has # HELP or # TYPE lines CWE-200 Apache modstatus exposed HIGH 200 + body contains "Apache Server Status" CWE-200 Spring Boot Actuator /actuator index HIGH 200 + body has "links" JSON OWASP A05:2021 Generic /admin returning 200 (not 401/403) HIGH 200 + HTML body with admin-shaped UI CWE-285 Elasticsearch cat exposed HIGH 200 + body matches health\s+status\s+index CWE-200 GraphQL Playground on prod MEDIUM 200 + body contains "GraphQLPlayground" CWE-200 Swagger UI on prod MEDIUM 200 + body contains "swagger-ui" CWE-200 Spring Boot Actuator /health exposed MEDIUM …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-debug-endpoints