log4shell-vulnerable-app

Vulnerable application This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, known as log4shell. It uses log-4j-core:2.14.1 through spring-boot-starter-log4j2 and openjdk:8u181 Running the application Run it: docker run --name vulnerable-app --rm -p 8080:8080...

CVE-2021-44228

🛡️ CVE-2021-44228: Log4Shell Analysis - The Vulnerability That Revolutionized Java Security Critical Impact CVSS 10.0 | Discovered in 2021, this flaw in Apache Log4j allows remote code execution RCE and affects millions of systems globally. Even today, it remains a key reminder for cybersecurity! ...

log4j-log4shell-affected

log4j-log4shell-affected Lists of affected components and affected apps/vendors by CVE-2021-44228 aka Log4shell or Log4j RCE for security responders. We believe it is important to classify the vendors and products between: 1. Internal risk - what you need to patch first to remove risk internally ...

CVE-2021-44228-poc

Log4Shell sample vulnerable application CVE-2021-44228 This is an almost copy/similar vulnerable application to https://github.com/christophetd/log4shell-vulnerable-app The main differences are maven instead of gradle, and the usage of rogue-jndi. This repository contains a maven Spring Boot web...

Log4j-Scanner-Exploit

Log4Shell-Scanner-Exploit Bash script to remotely identify and/or exploit the Log4j vulnerability. This tool performs various tests using LDAP payloads and X-Api-Version, User-Agent, and X-Forwarded-For headers. Always use this script with prior authorization from the owner of the audited...

log4shell_ioc_ips

j4shelliocips big dump from known log4j/log4shell malicious ip adresses unique and sorted update once a hour only if changes were made! CVE-2021-44228 happy hunting disclaimer This script is parsing a lot of Source so this list maybe has a lot of false positives don't block all ips in your...

Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell Vulnerability Complete Replication Record This record is based on the Apache Solr 8.11.0 target environment provided by Vulhub, fully replicating the Log4j2 JNDI injection vulnerability, and successfully verifying the vulnerability's existence through DNSLog and local LDA...

l4s-vulnapp

Log4Shell Vulnerable Applicationl4s-vulnapp This is a potentially vulnerable Java web application containing Log4j2.14.1 affected by log4shellCVE-2021-44228. Verified environment and various versions AdoptOpenJDK 17.0.10+7 Gradle 8.6 Gretty 4.1.2 Apache Tomcat 10.1.15 Apache Log4j Core 2.14.1...

-Unveiling-the-Lessons-from-Log4Shell-A-Wake-Up-Call-for-Cybersecurity-

This repository does not have a README...

ansible-role-log4shell

lucab85.ansiblerolelog4shell Ansible role to scan target Linux hosts using the official Red Hat Log4j detector script RHSB-2021-009 for Log4Shell CVE-2021-44228. Tested with Red Hat version 1.3 detector 2022-01-10. Ansible Playbook Code also available as Ansible Playbook...

log4v-vuln-check

Log4JS File & Vulnerability Scanner + Local Port Bind Scanner This script is used to perform a fast check to see if your server is possibly affected by CVE-2021-44228 the log4j vulnerability. It does not provide 100% guarantee that you are not vulnerable, but it gives a hint if it is possible tha...

nginx-mitigate-log4shell

nginx-mitigate-log4shell Mitigate log4shell CVE-2021-44228 and CVE-2021-45046 vulnerability attacks using Nginx LUA script Requires the Nginx lua module https://www.nginx.com/resources/wiki/modules/lua/ to be enabled. Use include /path/to/mitigate-log4shell.conf; in the server ... context. Can be...

log4shell_scanner

log4shellscanner Quick and dirty scanner, hitting common ports looking for Log4Shell CVE-2021-44228 vulnerability This utilizes wget, curl, nmap, and the Log4Shell Huntress LDAP endpoint: https://log4shell.huntress.com/ If you need to scan a private subnet that doesn't have internet access, you c...

Log4j-Scanner-Exploit

Log4Shell-Scanner-Exploit Bash script that allows identifying and/or exploiting the Log4Shell vulnerability remotely. This tool performs various tests using LDAP payloads and X-Api-Version, User-Agent, and X-Forwarded-For headers. Always use this script with prior authorization from the owner of...

CVE-2021-44228

CVE-2021-44228 Log4Shell Proof of Concept CVE-2021-44228 Make sure to use Java 8 JDK. Java 8 Download Images Credits Casey Dunham - Java Reverse Shell kozmer - Initial PoC Legal The author of this script does NOT take any responsibility of how this piece of code is used! This was created solely...

CVE-2021-44228-Apache-Log4j

CVE-2021-44228Apache Log4j Remote Code Execution） Versions Affected: all versions from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 Security Advisories / Bulletins linked to Log4Shell CVE-2021-44228 Usage: 1. 下载该项目，编译InjectClazz.java download git clone...

log4j-quick-scan

log4j-quick-scan Scan your IP network and determine hosts with possible CVE-2021-44228 vulnerability in log4j library. There are far better and advanced tools for security audit, but many of them requires commercial penetration software or external, 3rd party service or software. This script is...

log4j-CVE-2021-44228

log4j-CVE-2021-44228 On December 5, 2021, Apache identified a vulnerability later identified as CVE-2021-44228 in their widely used Log4j logging service. The vulnerability, also known as Log4shell, enables attackers to gain full control of affected servers by allowing unauthenticated remote code...

nmap-log4shell

Nmap Log4Shell NSE script for discovery Apache Log4j RCE CVE-2021-44228 nmap-log4shell is a NSE script for discovery Apache Log4j RCE CVE-2021-44228 vulnerability across the network. The script is able to inject the log4shell exploit payload via HTTP Headers default or via TCP/UDP socket...

Sandbox-Challenge-Log4Shell-CVE-2021-44228-

Sandbox Challenge: Log4Shell CVE-2021-44228 Overview This walkthrough documents the steps taken to complete the CISA Threat Sandbox Challenge for CVE-2021-44228, commonly known as Log4Shell. The challenge involved completing two objectives — one red team offensive and one blue team defensive —...