f0ng/log4j2burpscannerCVE-2021-44228 Log4j2 BurpSuite Scanner,Customize ceye.io api or other apis,including internal networks
交流群
二维码失效请加微信f-f0ng、备注log4j2burpscanner交流
关注主页公众号（only security），回复log4j2burpscanner获取下载地址】
1.fix bugs
prefixparam
suffixparamisusepointBypas,change to custom param
1.add polling dnslog query including active scanning and passive scanning
1.Send to log4j2 Scannerthe bypass payload of jndi: is used for testing. at now it includes the following three typesj${::-n}di:、 jn${env::-}di:、j${sys:k5:-nD}${lower:i${web:k5:-:}}
1.add passive switch log4j2 Passive Scanner，add log4j2 Scanner menu button Send to log4j2 Scanner
2.update payload param，add random character string，distinguish between the same site and the same path, optimization %20 problem
3.recognize multipart/form-data type、xml type
fix parameter issue for creating initial properties file
1.change the UI page
2.add isip param(for the case that there is no domain name and only IP detection in the intranet) but this kind of test has no parameter point digital ID and no host
If there are no other good intranet dnslog tools to replace, you can link the tools of KpLi0rn https://github.com/KpLi0rn/Log4j2Scan
1.add dnsldaprmi param (dns、ldap、rmi) default dns
2.add isContenttypeRefererOrigin param 、isAccept param
isContenttypeRefererOrigin param(whether test Content-Type、Referer、Origin)default off
isAccept param(whether test Accept-Language、Accept、Accept-Encoding)default off
3.add bypass jndi: ,but the effect is not good,use with caution
jndi: bypass methods https://twitter.com/ymzkei5/status/1469765165348704256
4.add log.xn--9tr.com to the white list
1.add bypass rc1,add space to the payload
2.more accurate
3.add Intranet dnslog api，can customize the ceye.io api or other apis，including internal networks
Param 1：isprivatedns(whether to use private dns api)
Param 2：privatednslogurl(internal dnslog address)
Param 3：privatednslogurl(internal dnslog response address)
4.add controllable params to control the payload
Param 4：isuseUserAgenttokenXff(whether test User-agent、token、X-Forward-for、X-Client-IP) default on
Param 5：isuseXfflists(whether test xff lists，including others xff)default off
Param 6：isuseAllCookie(whether test all cookie)default on
0x01 More accurate
0x02 Add Intranet dnslog api，can customize the ceye.io api or other apis，including internal networks
Since I don't have an intranet dnslog address，here I use ceye.io to test
Just ensure the connectivity between intranet and Intranet dnslog address, intranet and dnslog response address
0x03 Add controllable params to control the payload
Fix problem： Due to the vulnerability of the sub domain name, the primary domain name will also report the vulnerability
1.add request headers
["X-Forwarded-For","X-Forwarded","Forwarded-For","Forwarded","X-Requested-With","X-Requested-With", "X-Forwarded-Host","X-remote-IP","X-remote-addr","True-Client-IP","X-Client-IP","Client-IP","X-Real-IP","Ali-CDN-Real-IP","Cdn-Src-Ip","Cdn-Real-Ip","CF-Connecting-IP","X-Cluster-Client-IP","WL-Proxy-Client-IP", "Proxy-Client-IP","Fastly-Client-Ip","True-Client-Ip","X-Originating-IP", "X-Host","X-Custom-IP-Authorization","X-original-host","If-Modified-Since"]
1.add recognizable format
body={"a":"1","b":"22222"}