An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

Last update: Nov 21, 2022

Related tags

Security related resources Log4JHunt

Overview

Log4JHunt

An automated, reliable scanner for the Log4Shell CVE-2021-44228 vulnerability.

Video demo:

Usage

Here the help usage:

$ python3 log4jhunt.py

          +--------------+
              Log4JHunt
          +--------------+

[+] Log4jHunt by RedHunt Labs - A Modern Attack Surface (ASM) Management Company
[+] Author: Pinaki Mondal (RHL Research Team)
[+] Continuously Track Your Attack Surface using https://redhuntlabs.com/nvadr.

[-] You have to supply at least a single host to scan!

usage: log4jhunt.py [-h] [-u URL] [-f FILE] [-d DELAY] [-t TIMEOUT] [-T TOKEN] [-E EMAIL] [-W WEBHOOK] [-S SERVER] [-ua USERAGENT] [-m METHOD] [-H HEADERS] [-p PROXY]

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     URL to probe for the vulnerability.
  -f FILE, --file FILE  Specify a file containing list of hosts to scan.
  -d DELAY, --delay DELAY
                        Delay in-between two concurrent requests.
  -t TIMEOUT, --timeout TIMEOUT
                        Scan timeout for a single host.
  -T TOKEN, --token TOKEN
                        Canary token to use in payloads for scanning.
  -E EMAIL, --email EMAIL
                        Email to receive notifications.
  -W WEBHOOK, --webhook WEBHOOK
                        Webhook URL to receive notifications.
  -S SERVER, --server SERVER
                        Custom DNS callback server for receiving notifications.
  -ua USERAGENT, --user-agent USERAGENT
                        Custom user agent string to use for requests.
  -m METHOD, --methods METHOD
                        Comma separated list of HTTP Method to use
  -H HEADERS, --headers HEADERS
                        Comma separated list of custom HTTP headers to use.
  -p PROXY, --proxy PROXY
                        HTTP proxy to use (if any).

Getting a token

The tool makes use of Log4Shell tokens from Canary Tokens. The tool has capability to automatically generate tokens, if the values of the token (--token) and server (--server) are empty.

Once the token is generated, the token and the auth value are written to a file called canary-token.json.

Targets specification

You can specify the targets in two modes:

Scan a single URL:
```
./log4jhunt.py -u 1.2.3.4:8080 ...
```
Use a file to specify a list of targets:
```
./log4jhunt.py -f targets.txt ...
```

Specifying notification channels

There are two ways in which you can receive notification channels:

email (--email) -- service provided by Canarytokens.
webhook (--webhook) -- service provided by Canarytokens.
custom server (--server) -- you own custom DNS callback server.

Once the tool finds a vulnerable server, notifications would be relayed back to your preferred communication channel.

Sending requests

You can customize the HTTP methods using --methods.
A custom set of HTTP headers can be specified via --headers respectively.
A custom user agent can be specified using --user-agent header.
You can specfy a custom timeout value using --timeout.
You can specify custom proxies to use in HTTP requests via --proxy.

Specifying delay

Since a lot of HTTP requests are involved, it might be a cumbersome job for the remote host to handle the requests. The --delay parameter is here to help you with those cases. You can specify a delay value in seconds -- which will be used be used in between two subsequent requests to the same port on a server.

More details around the Log4J

We have covered more details around Log4j Vulnerability in our Blog.

License & Version

The tool is licensed under the MIT license. See LICENSE.

Currently the tool is at v0.1.

Credits

The Research Team at RedHunt Labs would like to thank Thinkst Canary for the awesome Canary Token Project.

To know more about our Attack Surface Management platform, check out NVADR.

You might also like...

open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability

CVE-2021-44228-log4jVulnScanner-metasploit open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability pre

7 Nov 9, 2022

A scanner and a proof of sample exploit for log4j RCE CVE-2021-44228

1.Create a Sample Vulnerable Application . 2.Start a netcat listner . 3.Run the exploit . 5.Use jdk1.8.0_20 for better results . Exploit-db - https://

7 Aug 6, 2022

IP Denial of Service Vulnerability ")A proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability ")

CVE-2021-24086 This is a proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability "), a NULL dereference in tcpip.sys patc

1 Nov 25, 2021

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

About create a target list or select one target, scans then exploits, done! Vulnnr is a Vulnerability Scanner & Auto Exploiter You can use this tool t

108 Dec 4, 2021

Releases(v0.1)

v0.1(Dec 16, 2021)
Initial release of Log4JHunt is out!

Features include:

automatic canarytoken generation with just email / webhook.

custom DNS server support.

multiple HTTP methods and HTTP body fuzzing.

For more details, check out the README!
Source code(tar.gz)
Source code(zip)

An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

Related tags

Overview

Log4JHunt

Usage

Getting a token

Targets specification

Specifying notification channels

Sending requests

Specifying delay

More details around the Log4J

License & Version

Credits

You might also like...

open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability

A scanner and a proof of sample exploit for log4j RCE CVE-2021-44228

IP Denial of Service Vulnerability ")A proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability ")

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

CVE-2022-22536 - SAP memory pipes(MPI) desynchronization vulnerability CVE-2022-22536

A small Minecraft server to help players detect vulnerability to the Log4Shell exploit 🐚

POC for detecting the Log4Shell (Log4J RCE) vulnerability.

POC for detecting the Log4Shell (Log4J RCE) vulnerability

A Burp Pro extension that adds log4shell checks to Burp Scanner

Releases(v0.1)

v0.1(Dec 16, 2021)

Owner

RedHunt Labs

自动化爆破子域名，并遍历所有端口寻找http服务，并使用crawlergo、dirsearch、xray等工具扫描并集成报告；支持动态添加扫描到的域名至任务；

Polkit - Local Privilege Escalation (CVE-2021-3560)

Malware arcane - Scripts and notes on my malware analysis journey

Yesitsme - Simple OSINT script to find Instagram profiles by name and e-mail/phone

Python3 script for scanning CVE-2021-44228 (Log4shell) vulnerable machines.

This repo explains in details about buffer overflow exploit development for windows executable.

Hikvision 流媒体管理服务器敏感信息泄漏

Obfuscate ip address using different encodings

Threat Intel Platform for T-POTs

TightVNC Vulnerability.

Lnkbomb - Malicious shortcut generator for collecting NTLM hashes from insecure file shares

Implementation of an attack on a tropical algebra discrete logarithm based protocol

A web-app helping to create strong passwords that are easy to remember.

Tor Relay availability checker, for using it as a bridge in countries with censorship

A brute Force tool for Facebook

This script checks for any possible SSRF dns/http interactions in xmlrpc.php pingback feature

A script to search, scrape and scan for Apache Log4j CVE-2021-44228 affected files using Google dorks

Cryptick is a stock ticker for cryptocurrency tokens, and a physical NFT.

A python script to decrypt media files encrypted using the Android application 'Decrypting 'LOCKED Secret Calculator Vault''. Will identify PIN / pattern.

MTBLLS Ethical Hacking Tool Announcement of v2.0