akpotter / Log4j-RCE-Scanner

Remote command execution vulnerability scanner for Log4j.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Log4j-RCE-Scanner

GitHub last commit

FeatureRequirementsInstallationUsageContact


RCE scanner for Log4j

Using this tool, you can scan for remote command execution vulnerability CVE-2021-44228 on Apache Log4j at multiple addresses.

Affected versions < 2.15.0

Features

  • It can scan according to the url list you provide.
  • It can scan all of them by finding the subdomains of the domain name you give.

Requirements

  1. httpx
  2. curl

If you want to scan with a domain name, you must additionally install subfinder, assetfinder and amass.

Installation

  1. git clone https://github.com/adilsoybali/Log4j-RCE-Scanner.git
  2. cd Log4j-RCE-Scanner
  3. chmod +x log4j-rce-scanner.sh

Usage

./log4j-rce-scanner.sh -h

This will display help for the tool. Here are all the switches it supports.

-h, --help - Display help
-l, --url-list - List of domain/subdomain/ip to be used for scanning.
-d, --domain - The domain name to which all subdomains and itself will be checked.
-b, --burpcollabid - Burp collabrator client id address or interactsh domain address.

Example uses:
./log4j-rce-scanner.sh -l httpxsubdomains.txt -b yrt45r4sjyoj19617jem5briio3cs.burpcollaborator.net
./log4j-rce-scanner.sh -d adilsoybali.com -b yrt45r4sjyoj19617jem5briio3cs.burpcollaborator.net

Click here to go to Interactsh.

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

  1. Fork the Project
  2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
  3. Commit your Changes (git commit -m 'Add some AmazingFeature')
  4. Push to the Branch (git push origin feature/AmazingFeature)
  5. Open a Pull Request

Contact

Email Linkedin Discord Twitter Personal Web Site

Acknowledgments

Stargazers over time

Stargazers over time

About

Remote command execution vulnerability scanner for Log4j.

License:GNU General Public License v3.0


Languages

Language:Shell 100.0%