# pmiaowu/BurpShiroPassiveScan

一款基于BurpSuite的被动式shiro检测插件

Repository: https://github.com/pmiaowu/BurpShiroPassiveScan
Canonical: https://ross.abutalabs.com/products/burpshiropassivescan
Language: Java
License Family: other
Last push: 2022-12-14T20:55:01+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2240, "days_push": 1358, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1806, forks 158 (observed 2026-08-28T04:05:39.135464+00:00)

## What it is
A passive BurpSuite extension written in Java that automatically detects Apache Shiro framework usage and tests for known Shiro encryption keys (CBC and GCM) on traffic passing through the proxy. It runs per unique domain+port without requiring manual rememberMe cookie manipulation.

## Use cases
- detect shiro framework fingerprint during pentests
- find leaked shiro encryption keys passively
- scan burp traffic for shiro deserialization vulnerabilities
- avoid manual rememberMe cookie testing
- check cbc and gcm shiro keys on websites

## When to choose
- you are doing authorized penetration testing on Java web apps
- you want passive shiro detection while browsing targets in BurpSuite
- you need fast shiro key brute-forcing without DNSLog callbacks

## When to avoid
- you need active scanning outside of BurpSuite
- you target non-Java or non-Shiro applications
- you lack authorization to test the target systems

## Facets
- artifact type: plugin
- maturity: maintenance
- function: security, vulnerability-scanning, penetration-testing
- domain: security, penetration-testing, developer-tools
- platform: jvm, cross-platform
- tags: burpsuite-extension, shiro, passive-scanning, deserialization, security-testing

## Member repositories
- pmiaowu/BurpShiroPassiveScan (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:39.135464+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:21:31.829849+00:00, confidence not recorded.
  - readme: https://github.com/pmiaowu/BurpShiroPassiveScan (fetched 2026-08-28T04:05:39.135464+00:00, sha 020fa55da5b9)
- Data as of 2026-08-30T08:39:29.467469+00:00.