whwlsfb / log4j2scan Goto Github PK
View Code? Open in Web Editor NEWLog4j2 RCE Passive Scanner plugin for BurpSuite
License: Apache License 2.0
Log4j2 RCE Passive Scanner plugin for BurpSuite
License: Apache License 2.0
dnslogcn跟自己编译的ceye测试都能有请求,但是dashboard这里不提示有漏洞。
建议加上json格式参数的漏洞扫描
必须要自己搭建godnslog才可以使用嘛
是对JAVA版本有要求吗
how can i add this to burp plugins
Could add the DNSlog method of RevSuit?
看正确的好像变成这样了
GET /getsubdomain.php?t=0.892059940138602 HTTP/1.1
Host: www.dnslog.cn
Pragma: no-cache
Cache-Control: no-cache
之前基于大佬的0.7版本写了个内网扫描的,但是paramfuzz里面有些问题。 问下这个0.9版本的RevSuitRMI是给内网用的么?
微信群进不去 求拉vx:Coder19
能否添加支持自建的interactsh平台?可提供测试环境
在测试过程中发现 一些网站存在cdn或者waf会进行拦截请求,,但是目标是存在漏洞的,,需要手动添加bypass绕过poc进行测试,希望可以添加手动增加插件poc的功能 这样测试起来会方便很多效率也会提高。
建议poc也能在界面选择
日志如下:
Log4j2Scan v0.12
Log4j2Scan loaded successfully!
Scanning: http://123.58.224.8:30596/hello?payload=111
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
Scan complete: http://123.58.224.8:30596/hello?payload=111 - No issue found.
Scanning: http://123.58.224.8:30596/
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
java.lang.IllegalArgumentException: method GET must not have a request body.
Scan complete: http://123.58.224.8:30596/ - No issue found.
Log4j2Scan loaded successfully!
Log4j2Scan loaded successfully!
Scanning: http://123.58.224.8:30596/hello?payload=111
Scan complete: http://123.58.224.8:30596/hello?payload=111 - No issue found.
已经无法正常发包,logger无发包记录。
这是咋用的 就bp抓包就然后工具就自己扫了呗 但是我看历史流量 没有payload啊。。。 我也不知到使用没,不太会用 大佬可以教我一下吗 还有群满了。。。想加
建议一次性在数据包中添加所有的请求头字段,比如X-Originating-IP、Client-IP、X-Forwarded-For全部放到一个请求包中,不然对一个数据包,插件要发送上百个请求太慢了(或者在GUI界面允许用户选择是否这么做)
看log日志记录发现没有对GET、POST参数进行fuzz,
是我的设置有问题吗?
发现对一些静态资源也会注入payload,像一些图片、CSS、js脚本、视频等响应类型可以过滤掉
这样就能和这个工具在内网联动了https://github.com/EmYiQing/JNDIScan/
public class Ceye implements IBackend {
OkHttpClient client = new OkHttpClient().newBuilder().
connectTimeout(3000, TimeUnit.SECONDS).
callTimeout(3000, TimeUnit.SECONDS).build();
String platformUrl = "http://api.ceye.io/";
String rootDomain = "xxx.ceye.io";
String token = "xxxx";
public Log4j2Scanner(final BurpExtender newParent) {
this.parent = newParent;
this.helper = newParent.helpers;
this.pocs = new IPOC[]{new POC1(), new POC2(), new POC3(), new POC4(), new POC11()};
this.backend = new Ceye("xxx.ceye.io", "xxxx");
if (this.backend.getState()) {
parent.stdout.println("Log4j2Scan loaded successfully!\r\n");
} else {
parent.stdout.println("Backend init failed!\r\n");
}
}
这样配置会导致打包失败,如果我直接在Log4j2Scanner中使用this.backend = new Ceye();可以打包,但收不到bp警告
jndi:
jn${env::-}di:
jn${date:}di${date:':'}
j${k8s:k5:-ND}i${sd:k5:-:}
j${main:\k5:-Nd}i${spring:k5:-:}
j${sys:k5:-nD}${lower:i${web:k5:-:}}
j${::-nD}i${::-:}
j${EnV:K5:-nD}i:
j${loWer:Nd}i${uPper::}
I think its time to add more waf bypass since jndi: part most likely blocked by waf right now
https://twitter.com/ymzkei5/status/1469765165348704256
目前在安全测试过程中发现一些系统存在响应延迟的问题,有时会延迟几小时甚至几天,建议作者大大增加一个可选项,在发送payload的时候增加外带域名信息。
你好,作者大哥,能不能再添加一个dnslog.cn方式类似dnslog接口
只需要自己填自己的一个 identifer 和url。不是写死的token。url的格式可以各种自定义,token只是url的一小部分而已。
url可以是:
http://www.MDNS.com/repoonsetoken=xxxxxxxx
http://www.MDNS.com/xxxxxxxx/*.xxxMDNS.com
比如:
https://github.com/f0ng/log4j2burpscanner这个dns自定义的添加方式
比如
随机字符.aaaa.com
然后再 www.mydnslog.cn 里面匹配 随机字符.aaaa.com 是否存在
Can you please add the feature to switch to bup collaborator in the extension itself?
There is an error when I try to compile java files to jar for add an extension for burp suite
Hello!
I've added the .jar file to my Burp Extensions extender tab and I get this following error:
initDomain failed: www.dnslog.cn: No address associated with hostname
${jndi%3aldap%3a//1639124684979z9ZTn./233266}
点后面没东西,可能是没有加载到dnslog的域名
我在测试的时候发现,如果ceye上没有收到http类型请求,只接收到DNS请求的话,就无法在burp上反馈探测出log4j2的RCE,要锁定就会变得相当麻烦,是否可以增添一下对ceye的dns类型的type的支持呢?
https://github.com/EmYiQing/JNDIScan 该项目用于内网检测很好,而且对于第三方dnslog不稳定,容易被ban,考虑增加个tab选项
代码逻辑缺陷导致Url fuzz失效。
国内的vps使用80端口必须备案域名才能访问,然而插件里面又没有提供更改端口号的选项,而是直接访问vps的80端口查询dns记录。所以如果自建的godnslog服务器在国内的话这个插件就用不了了。
1、建议界面增加DNSLOG配置
2、支持json格式fuzz
现在默认是发送绕过补丁的poc,在代码里写死了,能不能同时发送原版和绕过的呢?
我测试的是靶机,log4j2 漏洞的请求头的触发点环境,请求头 X-Api-Version字段
像这种需要发送到重放然后添加head的包是不是无法检测?
能备注一下 功能用法吗
burp.utils.ParamReplace@5cea84c9
burp.utils.ParamReplace@ed658a0
burp.utils.ParamReplace@23b61398
burp.utils.ParamReplace@52a161d
burp.utils.ParamReplace@dee16bd
burp.utils.ParamReplace@31c15cf8
burp.utils.ParamReplace@22f8a38b
burp.utils.ParamReplace@7737c33
很多 有时又没有
原来的说明是要改二个文件 现在没说明了 只说一个文件
纯白 不太了解哈 还有一个问题 这个支持1.7.32的么
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.