Performance Analysis of Heapdumpfinder and Dirsearch on Searching Vulnerability Heapdump Files in Spring Boot Web-Based Applications

Abstract

This research aims to analyze and compare the speed and accuracy of the Heapdumpfinder tool with Dirsearch in finding heapdump file vulnerabilities in spring boot-based web applications. Heapdump is a file that often contains sensitive data, such as credentials and authentication tokens, making it vulnerable to exploitation by attackers. Although Dirsearch is widely used in hidden file search, it has limitations in finding vulnerability of heapdump files in terms of speed and accuracy. To overcome this, Heapdumpfinder was created and customized to search for heapdump file vulnerabilities in the spring boot web framework. This tool utilizes fuzzing techniques and python-based asynchronous architecture to increase speed and accuracy in the search process. In the process of building the tool, the Rapid Application Development (RAD) framework is used to accelerate the development cycle iteratively. In addition, the performance evaluation of the tool is done using Confusion Matrix to measure the performance of the tool in finding heapdump files in more detail. The test results show that Heapdumpfinder excels in search speed and accuracy, and is able to minimize the risk of false positives compared to Dirsearch. Thus, Heapdumpfinder is expected to help pentesters and security researchers in finding vulnerabilities of heapdump files in the Spring Boot web framework.