GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → cisagov → log4j-scanner

cisagov / log4j-scanner

Licence: other
log4j-scanner is a project derived from other members of the open-source community by CISA to help organizations identify potentially vulnerable web services affected by the log4j vulnerabilities.

Programming Languages

java
68154 projects - #9 most used programming language
python
139335 projects - #7 most used programming language
Dockerfile
14818 projects

Labels

securitylog4jsecurity-toolscve-2021-44228cve-2021-45046

Projects that are alternatives of or similar to log4j-scanner

log4jscanwin
Log4j Vulnerability Scanner for Windows
Stars: ✭ 142 (-88.28%)
Mutual labels:  log4j, cve-2021-44228, cve-2021-45046
log4j-detector
Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!
Stars: ✭ 622 (-48.68%)
Mutual labels:  log4j, cve-2021-44228, cve-2021-45046
log4shell-finder
Fastest filesystem scanner for log4shell (CVE-2021-44228, CVE-2021-45046) and other vulnerable (CVE-2017-5645, CVE-2019-17571, CVE-2022-23305, CVE-2022-23307 ... ) instances of log4j library. Excellent performance and low memory footprint.
Stars: ✭ 22 (-98.18%)
Mutual labels:  log4j, cve-2021-44228, cve-2021-45046
log4shelldetect
Rapidly scan filesystems for Java programs potentially vulnerable to Log4Shell (CVE-2021-44228) or "that Log4j JNDI exploit" by inspecting the class paths inside files
Stars: ✭ 40 (-96.7%)
Mutual labels:  log4j, cve-2021-44228, cve-2021-45046
log4jshield
Log4j Shield - fast ⚡, scalable and easy to use Log4j vulnerability CVE-2021-44228 finder and patcher
Stars: ✭ 13 (-98.93%)
Mutual labels:  log4j, cve-2021-44228, cve-2021-45046
log4shell-tools
Tool that runs a test to check whether one of your applications is affected by the recent vulnerabilities in log4j: CVE-2021-44228 and CVE-2021-45046
Stars: ✭ 55 (-95.46%)
Mutual labels:  log4j, cve-2021-44228, cve-2021-45046
CVE-2021-44228-PoC-log4j-bypass-words
🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks
Stars: ✭ 760 (-37.29%)
Mutual labels:  log4j, cve-2021-44228, cve-2021-45046
cloudrasp-log4j2
一个针对防御 log4j2 CVE-2021-44228 漏洞的 RASP 工具。 A Runtime Application Self-Protection module specifically designed for log4j2 RCE (CVE-2021-44228) defense.
Stars: ✭ 105 (-91.34%)
Mutual labels:  log4j, cve-2021-44228
Log4j-RCE-Scanner
Remote command execution vulnerability scanner for Log4j.
Stars: ✭ 200 (-83.5%)
Mutual labels:  log4j, cve-2021-44228
nmap-log4shell
Nmap Log4Shell NSE script for discovery Apache Log4j RCE (CVE-2021-44228)
Stars: ✭ 54 (-95.54%)
Mutual labels:  log4j, cve-2021-44228
LogMePwn
A fully automated, reliable, super-fast, mass scanning and validation toolkit for the Log4J RCE CVE-2021-44228 vulnerability.
Stars: ✭ 362 (-70.13%)
Mutual labels:  log4j, cve-2021-44228
log4j-shell-poc
A Proof-Of-Concept for the CVE-2021-44228 vulnerability.
Stars: ✭ 1,536 (+26.73%)
Mutual labels:  log4j, cve-2021-44228
log4jpwn
log4j rce test environment and poc
Stars: ✭ 306 (-74.75%)
Mutual labels:  log4j, cve-2021-44228
awesome-list-of-secrets-in-environment-variables
🦄🔒 Awesome list of secrets in environment variables 🖥️
Stars: ✭ 538 (-55.61%)
Mutual labels:  log4j, cve-2021-44228
log4j-sniffer
A tool that scans archives to check for vulnerable log4j versions
Stars: ✭ 180 (-85.15%)
Mutual labels:  log4j, cve-2021-44228
Log4j-CVE-Detect
Detections for CVE-2021-44228 inside of nested binaries
Stars: ✭ 33 (-97.28%)
Mutual labels:  cve-2021-44228, cve-2021-45046
HackLog4j
《HackLog4j-永恒之恶龙》致敬全宇宙最无敌的Java日志库！Tribute to the most invincible Java logging library in the universe!
Stars: ✭ 161 (-86.72%)
Mutual labels:  log4j, cve-2021-44228
log4j-cve-2021-44228
Ansible detector scanner playbook to verify target Linux hosts using the official Red Hat Log4j detector script RHSB-2021-009 Remote Code Execution - log4j (CVE-2021-44228)
Stars: ✭ 58 (-95.21%)
Mutual labels:  log4j, cve-2021-44228
log4j-log4shell-affected
Lists of affected components and affected apps/vendors by CVE-2021-44228 (aka Log4shell or Log4j RCE). This list is meant as a resource for security responders to be able to find and address the vulnerability
Stars: ✭ 49 (-95.96%)
Mutual labels:  log4j, cve-2021-44228
Log4jPatcher
A mitigation for CVE-2021-44228 (log4shell) that works by patching the vulnerability at runtime. (Works with any vulnerable java software, tested with java 6 and newer)
Stars: ✭ 43 (-96.45%)
Mutual labels:  log4j, cve-2021-44228
View All Similar Projects ➔

Log4j Scanner

This repository provides a scanning solution for the log4j Remote Code Execution vulnerabilities (CVE-2021-44228 & CVE-2021-45046). The information and code in this repository is provided "as is" and was assembled with the help of the open-source community and updated by CISA through collaboration with the broader cybersecurity community. This is not intended to be a 100% true positive solution; False negatives may occur.

Official CISA Guidance & Resources

CISA Current Activity Alerts

CVE-2021-44228 & CVE-2021-45046

Steps to test

Configure your own DNS Server - Preferred)
- Add DNS records to your domain. (example.com)

  • A record with a value of your IP address (test.example.com -> )

  • NS record (ns1.example.com) with a value of the test.example.com as chosen above.

  • Host a DNS server to log DNS requests made to your domain.

  • Install the requirement modules -> pip3 install -r requirements.txt

  • Modify the dns/ddnsserver.py script with the value of the NS record above (test.example.com)

  • python3 ddnsserver.py --port 53 --udp >> dns-results.txt

  • Test it with nslookup hello.test.example.com. You can run tail -f dns-results.txt to monitor these logs.

  • You should see the entry in your dns-results.txt file after the nslookup command. Once you do, you're ready to scan!

  • Note: Same concepts will apply if you're using internal DNS to test this.

DNS providers - (Interact.sh or canarytokens.org)

  • Interact.sh - Interactsh is an open-source solution for out-of-band data extraction. It is a tool designed to detect bugs that cause external interactions. These bugs include, Blind SQLi, Blind CMDi, SSRF, etc.

  • Canarytokens.org - Canarytokens helps track activity and actions on your network.

LDAP Server (OPTIONAL)

  • Reference the README.md under the ldap directory if you'd also like to test a running LDAP server.

  • Build the project using maven. cd ldap

  • mvn clean package -DskipTests

  • nohup java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:8080/#payload" 443 >> ldap_requests.txt &

  • There are alternatives to this project as well.

HTTP Service Discovery & Scanning

  • Gather your most update-to-date asset list of your organization and find web services. Though this vulnerability does not solely affect web services, this will serve as a great starting point to minimizing the attack surface.

  • If you have a list of company owned URLS, you may skip this step: Utilize some well known tools like httpprobe or httpx to identify web services running on multiple ports. Basic Example: httpprobe -> cat list-of-your-company-domains.txt | $HOME/go/bin/httprobe > your-web-assets.txt

  • Now that you have a list of URLs, you're ready to scan: python3 log4j-scan.py --run-all-tests --custom-dns-callback-host test.example.com -l web-asset-urls.txt

  • Be sure to scan for the new CVE as well -> python3 log4j-scan.py --test-CVE-2021-45046 --custom-dns-callback-host test.example.com -l web-asset-urls.txt

  • Monitor the DNS server configured in Step 2.

CREDITS

As many in industry, we did not feel the need to "re-invent the wheel". This recommended scanning solution is derived from the great work of others (with slight modifications). We've included two additional projects to avoid using third-parties.

log4-scanner - Log4j vulnerability scanning framework. Thank you to the @fullhunt.io team.

dns - Simple DNS server (UDP and TCP) in Python. Thank you @pklaus & @andreif.

ldap - Contains useful code to test the lookup() call. Thank you @mbechler

Issues

If you have issues using the code, open an issue on the repository!

You can do this by clicking "Issues" at the top and clicking "New Issue" on the following page.

Contributing

We welcome contributions! Please see here for details.

Disclaimers

  • There are likely additional, as yet unknown ways to leverage these (CVE-2021-44228 & CVE-2021-45046) vulnerabilities. CISA is staying vigilant across multiple platforms (blog posts, repos, tweets, etc.) to stay up-to-date as the log4j situation unfolds and progresses.

  • This repository will focus solely on providing tooling to help organizations look for a limited set of currently known vulnerabilities in assets owned by their organization.

  • For CISA's official guidance on these vulnerabilities, please follow this repository.

License

The following attributions are referenced and/or derivative works distributed with this source:

log4j_scanner Copyright 2021 Mazin Ahmed

Java Unmarshaller Security Copyright 2021 Moritz Bechler

MIT License Applicable to Original log4j_scanner and Java Unmarshaller Security Works: Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Simple DNS Server Copyright 2021 Andrei Fokau

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at:

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Any and all changes applied by CISA are in the public domain.

Legal Disclaimer

NOTICE

USE THIS SOFTWARE AT YOUR OWN RISK. THIS SOFTWARE COMES WITH NO WARRANTY, EITHER EXPRESS OR IMPLIED. THE UNITED STATES GOVERNMENT ASSUMES NO LIABILITY FOR THE USE OR MISUSE OF THIS SOFTWARE OR ITS DERIVATIVES.

THIS SOFTWARE IS OFFERED “AS-IS.” THE UNITED STATES GOVERNMENT WILL NOT INSTALL, REMOVE, OPERATE OR SUPPORT THIS SOFTWARE AT YOUR REQUEST. IF YOU ARE UNSURE OF HOW THIS SOFTWARE WILL INTERACT WITH YOUR SYSTEM, DO NOT USE IT.

NO ENDORSEMENT

CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by CISA.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].