Giter VIP home page Giter VIP logo

hupe1980 / scan4log4shell Goto Github PK

View Code? Open in Web Editor NEW
13.0 5.0 3.0 3.31 MB

Scanner to send specially crafted requests and catch callbacks of systems that are impacted by log4j log4shell vulnerability and to detect vulnerable log4j versions on your local file-system

License: MIT License

Makefile 1.90% Go 94.52% Shell 3.07% Dockerfile 0.51%
cve-2021-44228 log4j log4shell rce scanner vulnerability waf-bypass red-team blue-team fuzzing cve-2021-45046 form-detection auth dns cve-2021-45105

scan4log4shell's Issues

go mod tidy: go.mod file indicates go 1.17, but maximum supported version is 1.15

Look like this project only work with go-1.17 while default go rpm on centos 7 is only 1.15.

  • Still don't know how to fix this compilation error after reading R1.
[pi@centos7t01 scan4log4shell]$rpm -qa |grep golang
golang-1.15.14-1.el7.x86_64
golang-bin-1.15.14-1.el7.x86_64
golang-src-1.15.14-1.el7.noarch
[pi@va32centos7t01 scan4log4shell]$ cat /etc/redhat-release
CentOS Linux release 7.9.2009 (Core)
[pi@centos7t01 scan4log4shell]$ make setup
go mod tidy: go.mod file indicates go 1.17, but maximum supported version is 1.15
make: *** [setup] Error 1
[pi@centos7t01 scan4log4shell]$

R1: micro/go-micro#2367

run,run-local and run-remote not showing up from "make help"

Is this intentional ?

  • run,run-local and run-remote not showing up from "make help"
.PHONY: run
run:
	@go run *.go remote url -h

.PHONY: run-local
run-local:
	@docker-compose -f docker-compose.local.yml up --build

.PhONY: run-remote
run-remote:
	@docker-compose -f docker-compose.remote.yml up --build

Detect patched log4j-core-2*.jar ?

Hi

Can this program adding ability to check the .class are taken out of older log4j-core-.jar ?

Patched *.jar = jndiLookup.class removal and set log4j2.formatMsgNoLookups=true

Adding makefile target to build the tool only

Hi @hupe1980

I am hoping to use docker container as an isolated golang compiling environment, not doing the scan tests inside container.
Can you add a target to automate this goal using following example I found on internet ?
like "make docker-compile"

docker create -ti --name dummy IMAGE_NAME bash
docker cp dummy:/path/to/file /dest/to/file  # copy scan4log4shell out to local partition like /tmp.
docker rm -f dummy

Question

Hi,

Please tell me if this tool scans only the main index or there is a option to crawl and test the entire site? I'm sorry to ask, but I haven't seen anything about this.
Thank you

scan4log4shell remote url http://testphp.vulnweb.com -a
[i] Log4Shell Remote Vulnerability Scan
[i] Listening on c832bfasahsi8gnc8r20cednmxoyyyyyr.interact.sh
[i] Start scanning CIDR http://testphp.vulnweb.com
---------
[i] All request to http://testphp.vulnweb.com have been sent
[i] Completed scanning
[i] Waiting for incoming callbacks!
[i] Use ctrl+c to stop the program.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.