Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/ssstonebraker/log4j-scan-turbo
Multithreaded log4j vulnerability scanner using only bash! Tests all JNDI protocols, HTTP GET/POST, and 84 headers.
https://github.com/ssstonebraker/log4j-scan-turbo
bash kali log4j log4shell oscp oscp-tools osint pentesting security securty-tools shell
Last synced: 21 days ago
JSON representation
Multithreaded log4j vulnerability scanner using only bash! Tests all JNDI protocols, HTTP GET/POST, and 84 headers.
- Host: GitHub
- URL: https://github.com/ssstonebraker/log4j-scan-turbo
- Owner: ssstonebraker
- Created: 2021-12-11T04:34:51.000Z (about 3 years ago)
- Default Branch: main
- Last Pushed: 2021-12-20T02:42:36.000Z (almost 3 years ago)
- Last Synced: 2024-08-05T17:45:32.993Z (4 months ago)
- Topics: bash, kali, log4j, log4shell, oscp, oscp-tools, osint, pentesting, security, securty-tools, shell
- Language: Shell
- Homepage:
- Size: 35.2 KB
- Stars: 28
- Watchers: 3
- Forks: 4
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - ssstonebraker/log4j-scan-turbo - Multithreaded log4j vulnerability scanner using only bash! Tests all JNDI protocols, HTTP GET/POST, and 84 headers. (Shell)
README
# log4j-scan-turbo (Multi-threaded scanner)
Test for the log4j vulnerability ( CVE-2021-44228 ) across your external footprint.
This is a very fast, multi-threaded, log4j vulnerability tester.
## Details
- Pure bash scanner
- Uses nohup and curl to achieve multiple threads
- Curl configured to use a 3 second client to server maximum and six second total time setting.
- 48 parallel calls at a time
- Covers all jndi protocols
- HTTP GET/POST methods
## Example Use
```
git clone https://github.com/ssstonebraker/log4j-scan-turbo
cd log4j-scan-turbo
sudo ./log4j_CVE-2021-44228_tester.sh
```
## Payloads
```
Payloads:
${jndi:ldap:///a}
${jndi:ldaps:///a}
${jndi:rmi:///a}
${jndi:dns:///a}
${jndi:corba:///a}
${jndi:iiop:///a}
${jndi:nis:///a}
${jndi:nds:///a}
```
## Methods
HTTP GET and HTTP POST are called on TCP 80/443 for each ip/domain provided in the input file
## Requirements
You will need:
1. An inputfile with a list of IP addresses/domains (one per line)
2. A Canary Token (see below)
### Input File
Your input file should consist of IP address and/or Fully Qualified Domain Names
Example:
```
foo.com
bar.com
10.1.100.50
127.0.0.1:5000
```
### Get a Canary Domain
1. Browse to https://canarytokens.org/generate#
2. Selection Option "DNS"
3. Input Email Address
4. Input Comment
5. Hit "Create my Canary Token"
## False Positives
If you use egress SSL decryption + inspection this script may trigger false positives (as your IDS may perform lookups on the canary token.. thus triggering it).
If this is the case then you are better off running it from a cloud instance that is not being inspected.
## Local Testing
Spin up a docker image of a vulnerable server:
```
docker run --name vulnerable-app -p 555:8080 ghcr.io/christophetd/log4shell-vulnerable-app
```
Use the script to test locally:
```
echo "localhost:555" > ips.txt
sudo ./log4j-scan-turbo.sh ips.txt
```