https://github.com/yezzfusl/rustylog4jguard
Effortless Log4j vulnerability detection.
https://github.com/yezzfusl/rustylog4jguard
cve-2021-44228 cybersecurity exploit-detection infosec log4j log4shell malware-detection open-source penetration-testing rust rust-security security security-tools vulnerability-scanner
Last synced: about 2 months ago
JSON representation
Effortless Log4j vulnerability detection.
- Host: GitHub
- URL: https://github.com/yezzfusl/rustylog4jguard
- Owner: yezzfusl
- License: mit
- Created: 2024-08-15T01:25:08.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2024-08-15T01:57:55.000Z (almost 2 years ago)
- Last Synced: 2025-01-14T08:14:47.828Z (over 1 year ago)
- Topics: cve-2021-44228, cybersecurity, exploit-detection, infosec, log4j, log4shell, malware-detection, open-source, penetration-testing, rust, rust-security, security, security-tools, vulnerability-scanner
- Language: Rust
- Homepage: https://yezzfusl.vercel.app/blog/log4shell
- Size: 22.5 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# RustyLog4jGuard
Effortless Log4j vulnerability detection.
## Features
- Recursive scanning of directories for JAR and class files
- Multi-threaded parallel scanning for improved performance
- Identification of potential Log4Shell vulnerabilities
- Support for custom vulnerability patterns using regex
- File and directory exclusion patterns using glob syntax
- Multiple hashing algorithms for file integrity checks:
- SHA-256
- SHA-3
- Blake3
- Advanced analysis techniques:
- Entropy analysis for detecting obfuscated malicious code
- Fourier transform analysis for identifying hidden patterns
- Markov chain analysis for behavioral detection
- Configurable output formats (text and JSON)
- Progress bar for real-time scanning feedback
- Quiet mode for CI/CD integration
- Option to save results to a file
## Prerequisites
- Rust 1.54 or higher
- Cargo (Rust's package manager)
## Installation
1. Clone the repository:
`git clone https://github.com/yezzfusl/RustyLog4jGuard.git`
`cd RustyLog4jGuard`
2. Build the project:
`cargo build --release`
The compiled binary will be available in the `target/release` directory.
## Usage
Run the scanner with the following command:
`./target/release/cve_2021_44228_scanner [OPTIONS] --path `
### Options:
- `--path `: Specify the directory to scan (required)
- `--format `: Choose the output format (text or json) [default: text]
- `--threads `: Set the number of threads to use for scanning (optional)
- `--exclude `: Exclude files/directories matching the given glob pattern (can be used multiple times)
- `--custom-patterns `: Add custom vulnerability patterns as regex (can be used multiple times)
- `--quiet`: Enable quiet mode (only output vulnerable files)
- `--output `: Save results to the specified file
- `-h, --help`: Print help information
- `-V, --version`: Print version information
### Examples:
1. Scan a directory with default settings:
`./target/release/cve_2021_44228_scanner --path /path/to/scan`
2. Scan a directory and output results in JSON format:
`./target/release/cve_2021_44228_scanner --path /path/to/scan --format json`
3. Scan a directory using 8 threads:
`./target/release/cve_2021_44228_scanner --path /path/to/scan --threads 8`
## Output
The scanner provides two output formats:
1. Text (default): A human-readable summary of the scan results.
2. JSON: A detailed JSON output of all scan results, suitable for further processing or integration with other tools.
## Performance Considerations
- The scanner uses parallel processing to improve performance on multi-core systems.
- For large directories with many files, increasing the number of threads may improve scanning speed.
- Scanning speed may be limited by I/O performance, especially when dealing with many small files or scanning from a network drive.
## Limitations
- The scanner identifies potential vulnerabilities based on known patterns. It may produce false positives or miss sophisticated obfuscated vulnerabilities.
- Only JAR and class files are scanned. Other file types are ignored.
- The scanner does not decompile or deeply analyze the bytecode, which may limit its ability to detect certain vulnerability variations.
## Contributing
Contributions to improve the scanner are welcome. Please follow these steps:
1. Fork the repository
2. Create a new branch for your feature
3. Commit your changes
4. Push to your branch
5. Create a new Pull Request
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
## Disclaimer
This tool is provided as-is for informational and educational purposes only. It should not be considered as a comprehensive security solution. Always consult with cybersecurity professionals and perform thorough testing in controlled environments.
## Acknowledgments
- The Rust community for providing excellent libraries and tools
- The cybersecurity community for their continuous efforts in identifying and mitigating vulnerabilities