log4shell

Operational information regarding the log4shell vulnerabilities in the Log4j logging library.

LunaSec - Security & Compliance SDKs to stop data leaks in your software. With just a few lines, LunaSec adds a Zero Trust Architecture across your stack, Unique Per-Record Encryption, and protection from common security issues like XSS, SQL Injection, and RCE. Try it out live here: https://app.lunasec.dev

Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!

Find vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)

Simple local scanner for vulnerable log4j instances

log4j rce test environment and poc

Log4Shell RCE Exploit - fully independent exploit does not require any 3rd party binaries.

Remote command execution vulnerability scanner for Log4j.

An Awesome List of Log4Shell resources to help you stay informed and secure! 🔒

A collection of intelligence about Log4Shell and its exploitation activity.

A script that checks for vulnerable Log4j (CVE-2021-44228) systems using injection of the payload in common HTTP headers.

Ansible detector scanner playbook to verify target Linux hosts using the official Red Hat Log4j detector script RHSB-2021-009 Remote Code Execution - log4j (CVE-2021-44228)

log4j2 remote code execution or IP leakage exploit (with examples)

A tool for detect&exploit vmware product log4j vulnerability.

Tool that runs a test to check whether one of your applications is affected by the recent vulnerabilities in log4j: CVE-2021-44228 and CVE-2021-45046

A mitigation for CVE-2021-44228 (log4shell) that works by patching the vulnerability at runtime. (Works with any vulnerable java software, tested with java 6 and newer)

nse script to inject jndi payloads

Rapidly scan filesystems for Java programs potentially vulnerable to Log4Shell (CVE-2021-44228) or "that Log4j JNDI exploit" by inspecting the class paths inside files

Mitigate log4shell (CVE-2021-44228) vulnerability attacks using Nginx LUA script

Deobfuscate Log4Shell payloads with ease.

A Docker based LDAP RCE exploit demo for CVE-2021-44228 Log4Shell

Safelog4j is an instrumentation-based security tool to help teams discover, verify, and solve log4shell vulnerabilities without scanning or upgrading

log4j / log4shell IoCs from multiple sources put together in one big file (IPs) more coming soon (CVE-2021-44228)

Contains all my research and content produced regarding the log4shell vulnerability

Multithreaded log4j vulnerability scanner using only bash! Tests all JNDI protocols, HTTP GET/POST, and 84 headers.

Check, exploit, generate class, obfuscate, TLS, ACME about log4j2 vulnerability in one Go program.

Nmap Log4Shell NSE script for discovery Apache Log4j RCE (CVE-2021-44228)

log4jshell vulnerability scanner for bug bounty

Log4Shell Zero-Day Exploit Proof of Concept