# whwlsfb/JDumpSpider

HeapDump敏感信息提取工具

Repository: https://github.com/whwlsfb/JDumpSpider
Canonical: https://ross.abutalabs.com/products/jdumpspider
Language: Java
License: Apache-2.0
License Family: permissive
Topics: heapdump, jvm, pentesting, spring-boot, web
Last push: 2026-08-20T07:52:35+00:00

## Health v2 (maintenance only)
Score: 70/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 98, release rhythm 16, longevity 100
- inputs: {"age_days": 1701, "days_push": 13, "days_rel": 511, "gap_med": 118, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1680, forks 144 (observed 2026-08-28T04:05:21.567162+00:00)

## What it is
JDumpSpider is a Java CLI tool that extracts sensitive information (datasource credentials, config properties, Redis configs, Shiro keys, user credentials) from JVM heap dump files. It is aimed at penetration testers analyzing leaked heapdumps from Spring Boot and other Java applications.

## Use cases
- extract database credentials from a heapdump file
- analyze leaked spring boot actuator heapdump
- find redis passwords in jvm heap dump
- recover shiro rememberme keys from memory dump
- search heapdump for datasource and config secrets
- pentest tool to parse hprof heap dumps

## When to choose
- you have a JVM heap dump and need to pull credentials or secrets from it
- you are doing penetration testing on Java/Spring Boot applications
- you want a ready-made CLI instead of manually browsing heap dumps in MAT

## When to avoid
- you need general-purpose heap dump analysis or memory profiling rather than secret extraction
- the target application is not Java/JVM based
- you need a GUI-based memory forensics suite

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, parser, developer-tools
- domain: security, penetration-testing, developer-tools
- platform: cli, cross-platform, jvm
- tags: heapdump, jvm, memory-forensics, secret-extraction, spring-boot, pentesting, java

## Member repositories
- whwlsfb/JDumpSpider (main) score 70

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:21.567162+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:41:29.755790+00:00, confidence not recorded.
  - readme: https://github.com/whwlsfb/JDumpSpider (fetched 2026-08-28T04:05:21.567162+00:00, sha 58da2d363276)
- Data as of 2026-08-30T08:39:29.467469+00:00.