log4j2burpscanner

CVE-2021-44228, log4j2 Burp plugin Java version. DNSlog uses non-dnslog.cn domain names. Effect demonstration:

Target range (the range is relatively slow, but internet assets are fine. The reason might be that the range handles other request headers poorly, or the headers are too large, causing slow response from the range. Just wait a bit longer.)

Tested on two SRC sites.

After loading, a URL is provided. Visiting it allows you to view DNS records. Of course, the plugin itself checks DNS records; this only serves as a convenient way to view them later.

Features:

0x01 Send payloads based on Cookie fields, X-Forwarded-For header fields, and User-Agent header fields

0x02 Based on domain uniqueness, include the host in the DNSlog

The plugin mainly identifies five forms:

1. GET request: a=1&b=2&c=3

2. POST request: a=1&b=2&c=3

3. POST request: {"a":"1","b":"22222"}

4. POST request: a=1&param={"a":"1","b":"22222"}

5. POST request: {"params":{"a":"1","b":"22222"}}

Notes:

If testing in Repeater is needed,

You need to open Dashboard → Live passive crawl from Proxy and Repeater → Check Repeater

You need to open Dashboard → Live audit from Proxy and Repeater → Check Repeater

Disclaimer

Do not use the technology or code of this project for illegal purposes such as creating malicious software, stealing software copyrights/intellectual property, or improper profit-making. Engaging in the above actions or using this project to sniff data from programs not owned by yourself may violate Articles 217 and 286 of the Criminal Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Regulations on the Protection of Computer Software of the People's Republic of China, and other legal provisions. The technology mentioned in this project is only for private learning and testing in legitimate scenarios. Any criminal or civil liability arising from improper use of this technology is unrelated to the author of this project.