Vm4J

Vm4J 用于检测 VMware 产品 log4j 漏洞的工具。 工作原理 首先启动一个 JNDIExploit 服务器。 启动本工具并将配置设置为正确的选项。 发送 payload。 截图 支持 VMware HCX VMware vCenter VMware Workspace One（即将添加） VMware NSX VMware Horizon VMware vRealize Operations Manager 注意 1. 本项目使用 Visual Studio 2022 和 .NET Framework 4.5。 2. 调试模式下，本工具将代理设置为...

log4j_scanner_wrapper

用于扫描 Linux 目录以查找 log4j 漏洞 CVE-2021-44228 的封装脚本。 取自 https://github.com/logpresso/CVE-2021-44228-Scanner。致谢原作者。 扫描大多数可疑的主要目录，并会排除 nfs 挂载点。 用法 root@kitploit: bash log4jscanner.sh optionaljavapath 作者：Andrew Pomnean 和 Matt Cengic。...

vcenter-log4j

VMware vCenter log4j 回避策 VMware vCenter log4j 脆弱性 CVE-2021-44228 の回避策スクリプト（VMware KB 記事 に基づく）。 2021-12-13 02:09 UTC - Secure Token および Identity Management サービスを追加 2021-12-13 12:46 UTC - PSC Client for 6.5 を追加 - 以下を参照 VMware は KB 記事にリンクされた Python スクリプトを公開しています。彼らのバージョンの初期の問題は解決されたようです。 簡易手順 vCente...

Log4j-JNDIServer

Log4j-JNDIServer このプロジェクトは、Log4jの脆弱性CVE-2021-44228およびCVE-2021-45046をテストするのに役立ちます。 インストールとビルド IntelliJ IDEAでプロジェクトを読み込む 「プロジェクト設定」でJDKを選択 Ctrl + Alt + Shift + S 「プロジェクト設定」でアーティファクトを作成 - 「アーティファクト」 - 「モジュールからJARを作成」 - 「ライブラリからのJARファイル」で「ターゲットJARに抽出」を選択 - 「OK」 プロジェクトをビルド Ctrl +...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

Log4j-RCE-Exploiter

Log4j-RCE-Exploiter 针对 Log4j RCE CVE-2021-44228 的扫描器 安装 安装时，请以超级用户（ROOT）身份运行以下命令： root@kitploit: ▶ cd Log4j-RCE-Exploiter ▶ chmod 777 installer.sh ▶ ./installer.sh 使用 root@kitploit: ▶ log4jExploiter -d tesla.com -b 6nuulng8dd2sivtd3kht31s9e0kq8f.burpcollaborator.net -h, --help Display help -l,...

log4j-detector

Log4-detector Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228 CRITICAL, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It...

csp-log4j

csp-log4j 查找 CSP 报告 URL，并测试其是否存在 log4j 漏洞 安装 root@kitploit: go install github.com/randomrobbiebf/csp-log4j/ 运行 root@kitploit: csp-log4j -input file.txt -collab something.oastify.com...

log4j-fuzzer

log4j-fuzzer 针对单个目标 root@kitploit: chmod +x log4j 执行上述命令后，直接输入你的目标 root@kitploit: ./log4j YOURTARGETURL YOURREMOTESERVER 针对多个目标 将所有域名、子域名、目录收集到一个列表中 之后直接执行以下命令 root@kitploit: chmod +x log4j 你可以使用 https://github.com/projectdiscovery/interactsh 创建远程服务器，或者尝试使用 DNSLOG.CN root@kitploit: cat...

Search-log4Jvuln-AppScanSTD

使用 AppScan Standard 和网站列表搜索 log4J 漏洞 此 Powershell 脚本针对网站列表（URLs.txt）运行 AppScan Standard 扫描，仅检查 Log4J（CVE-2021-44228）漏洞。 项目结构： 运行脚本后，它将读取 URLs.txt 中的每一行并开始扫描 Log4J（CVE-2021-44228）漏洞。 每次扫描完成后，它将在 Log4JResultAnalysis.txt 中写入结果。 每个扫描文件位于 Scan 文件夹中，您可以在 AppScan Standard 中打开它以查看有关漏洞的详细信息。...

log4j-dork-scanner

Log4j dork 扫描器 这是一个自动脚本，用于使用 Google dorks 搜索、抓取和扫描受 Apache Log4j CVE-2021-44228 影响的文件。 安装： root@kitploit: git clone https://github.com/JagarYousef/log4j-dork-scanner cd log4j-dork-scanner pip install -r requirments.txt 扫描： root@kitploit: python scanner.py -d YOURSEARCHDORK -n...

log4jtest

简介 本仓库旨在利用 Docker 和 Hashicorp Terraform 快速测试 log4j 漏洞。该测试的所有组件都将运行在 Docker 网络中的 Docker 容器内，可通过 'host.docker.internal' 进行访问。 致谢 / 免责声明 该测试环境源自 Raxis 的一篇优秀博客文章：https://raxis.com/blog/log4j-exploit 易受攻击的应用程序和漏洞利用代码来自 cyberxml https://github.com/cyberxml/log4j-poc。 我所做的只是将环境代码化，使其易于快速启动并测试这个令人垂涎的漏洞。...

pulsar-docker-images-patch-CVE-2021-44228

使用 Apache Log4J 2.17.1 升级修补 Pulsar 镜像 涵盖 CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 CVE-2021-44832 更多信息请参见 Log4J 安全漏洞及升级。 解决方案请参见 Dockerfile 构建并推送修补后的 Docker 镜像 使用示例： root@kitploit: build and tag image docker build --build-arg=ORIGINALIMAGE=apachepulsar/pulsar-all:2.8.1 . -t...

Astra Linux – Vulnerability in Apache Log4j2

Apache Log4j2 versions 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 have JNDI features that are used in configuration, log messages, and parameters. However, these features do not protect against attacks from controlled LDAP endpoints and other JNDI-related...

Astra Linux – Vulnerability in Apache Log4j2

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not prevent uncontrolled recursion from self-referential lookups. This allowed an attacker with control over the Thread Context Map data to cause a denial of service when a crafted string was interpreted. This issue w...

Security Bulletin: due to the use of Apache Log4j, IBM Transformation Extender Advanced is vulnerable to hostname verification bypass and log injection via CRLF sequences

Summary Apache Log4j is used by IBM Transformation Extender Advanced also known as IBM Standards Processing Engine as part of common utility helpers. Apache Log4j has been updated to address CVE-2026-34477 which causes hostname verification bypass and CVE-2026-34478 which causes log injection via...

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j. Even though Rhapsody risk impact was low we have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind

Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell CVE-2021-44228 Proof-of-Concept Lab An isolated...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j. Even though Rhapsody risk impact was low We have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appende...