Simple bash script to test your WAF or other devices against Log4Shell attack strings and various bypasses

Bypass tricks from: https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words

To run:

./cve-2021-44228.sh -t <URL of the target> -c <HTTP Status Code expected>

Or to use the defaults of https://127.0.0.1 and 403:

./cve-2021-44228.sh

For each test string, this will pass the string into a request to the target using various vectors such as:

Headers: Using the User-Agent header
URI: Appending the string to requested URI
Cookies: As the data value of a Cookie
Query String: As the value of a query string parameter
POST Body Data: As the body data of a POST request

Example output:

Test String: ${jndi:}
-------------------------------------------------------------
HEADERS: curl -ksg -w "%{http_code}" https://127.0.0.1 -A '${jndi:}'
    403
URI: curl -ksg -w "%{http_code}" 'https://127.0.0.1/${jndi:}'
    403
Cookies: curl -ksg -w "%{http_code}" https://127.0.0.1 -b 'session=${jndi:}'
    403
Query String: curl -ksg -w "%{http_code}" 'https://127.0.0.1/something?session=${jndi:}'
    403
POST Data: curl -X POST -ksg -w "%{http_code}" https://127.0.0.1 -d '${jndi:}'
    403

cve-2021-44228-waf-tests

Most Popular