wyzxxz/heapdump_tool

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1457 stars · 141 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Java-based CLI tool that parses JVM heapdump files (via jhat) to search for sensitive information such as plaintext passwords, cloud access keys (AK/SK), Shiro keys, URLs, IPs, and file paths. It is primarily used by security professionals to verify Spring Boot actuator heapdump leaks during authorized assessments.

Use cases

• extract plaintext passwords from a spring boot heapdump file
• find access key and secret key leaks in heap dumps
• search heapdump for shiro rememberme keys
• query heap dump for urls ips and file paths
• analyze actuator heapdump leak during pentest
• search java heap dump with regex or keyword
• dump system properties from a heapdump file

When to choose

• you have an authorized engagement involving exposed Spring actuator heapdump endpoints
• you need to quickly search large JVM heap dumps for credentials, keys, or configuration secrets
• you want an interactive keyword/regex/class-based query interface over heap dump objects

When to avoid

• you need general-purpose heap dump analysis or profiling rather than secret hunting (use Eclipse MAT or VisualVM)
• you cannot install a JDK with jhat available on the machine
• you lack authorization to analyze the heap dump

Facets

cli-tool · maturity maintenance

security search-engine parser developer-tools security penetration-testing developer-tools cli cross-platform jvm heapdump jhat sensitive-information spring-actuator shiro security-audit credential-extraction java

Member repositories

For agents

markdown · JSON · MCP: product_card(name="wyzxxz/heapdump_tool")