DOCSEARCHbyAlgolia
Submit Docs

log4j2burpscanner

repository·main·Indexed 21 days ago

https://github.com/f0ng/log4j2burpscanner

A Burp Suite plugin designed to detect CVE-2021-44228 (Log4j2 RCE) vulnerabilities. It supports passive and active scanning by injecting payloads into HTTP request components—including headers, cookies, and various POST formats (JSON, nested JSON, body wrappers)—and monitoring for DNS, LDAP, or RMI callbacks via DNSLog services such as ceye.io or private internal DNSLog APIs.

Tokens
3.5K
Snippets
7
Records
25
Agent score
74%

What's inside log4j2burpscanner

  1. Configure DNSLog platforms

    main

    The plugin uses DNSLog to detect Log4j2 vulnerabilities. You have three configuration options depending on your environment:

    1. Default DNSLog: If https://log.xn--9tr.com is accessible, no further configuration is required.
    2. ceye.io: If the default is inaccessible, configure ceye.io by setting isceye to true and providing your token and ceye.io address.
    3. Intranet/Private DNSLog: If you require an internal DNSLog, set isceye to false and provide the privatednslogurl and privatednsResponseurl.

  2. Install and use log4j2burpscanner

    main

    To use the tool, you must download the source code and compile it. The tool is a Burp Suite plugin designed to detect CVE-2021-44228 (Log4j2) vulnerabilities by sending payloads via various request parameters and headers, using DNS/LDAP/RMI to verify successful exploitation.

    Key Features:

    • Sends payloads via Cookie fields, XFF headers, and User-Agent headers.
    • Incorporates the hostname into the DNSLog record for precise identification.
    • Supports multiple request formats including GET/POST with query strings, JSON bodies, and nested JSON parameters.
    # Download the source code and compile it

  4. Configure Burp Suite to test in Repeater

    main

    To enable Log4j2 scanning for requests sent via the Burp Suite Repeater module, you must adjust the plugin's dashboard settings to include Repeater traffic.

    Follow these steps in the Burp Suite dashboard:

    1. Locate the Live passive crawl from Proxy and Repeater setting and ensure repeater is checked.
    2. Locate the Live audit from Proxy and Repeater setting and ensure repeater is checked.
    ![image](https://user-images.githubusercontent.com/48286013/145667621-449187be-d259-4567-8c1d-1619e0009411.png)
![image](https://user-images.githubusercontent.com/48286013/145667631-301fb788-30da-42b9-b038-98fa71ef835a.png)

  5. Configure custom DNSLog (IP type)

    main

    For monitoring platforms that use IP-based listeners (internal network monitoring):

    1. Set privatednslogurl to the internal IP or domain (e.g., 127.0.0.1:8001).
    2. Check the isip box to indicate the DNSLog is an IP address.
    3. Click Save configuration.

    Warning: If isip is enabled, the plugin may not include parameter identifiers in the payload. Uncheck isip if you need the payload to explicitly identify the parameter being tested.

  7. Compile log4j2burpscanner from source

    main

    If you encounter import errors or JDK compatibility issues, you can compile the plugin yourself:

    1. Download the source code.
    2. Run the following command in the terminal:
    mvn package
    1. The resulting .jar file will be located in the target directory. Import this JAR into Burp Suite.

  8. Install and use log4j2burpscanner

    main

    To use the plugin, follow these steps:

    1. Download: Get the latest plugin version from the releases page.
    2. Load: Load the plugin into Burp Suite.
    3. DNSLog Setup:
      • If the default DNSLog (https://log.xn--9tr.com) is accessible, no further configuration is needed.
      • If the default is inaccessible, configure ceye.io: set isceye to true, and provide your ceyetoken and ceyednslog (the record domain).
      • For Internal/Private DNSLog: set isceye to false, enter your internal DNSLog domain in privatednslogurl, and the viewing address in privatednsResponseurl.
    4. Scanning:
      • The plugin uses a Passive interface. If you reload the plugin, it won't automatically scan previous requests. To scan specific requests, right-click the request and select send to log4j2 scanner.
      • Ensure passive scanning is enabled in the Dashboard module.
      • Ensure the host is not in the white lists.
    # Download from releases
# Load into Burp
# Right-click request -> send to log4j2 scanner

  9. Configure custom DNSLog (URL type)

    main

    If you are using a custom DNSLog platform that uses a URL-based retrieval method (e.g., http://your-dnslog-domain/your-token), configure it as follows:

    1. Set privatednslogurl to your DNSLog record domain (e.g., test.f0ng.cn).
    2. Set privatednsResponseurl to the full URL used to view the response (e.g., http://1.1.1.1/f0ngf0ng).
    3. Click Save configuration.

    Note: If you are using an IP-based monitoring platform, set privatednslogurl to the IP/domain (e.g., 127.0.0.1:8001) and ensure the isip checkbox is checked.

  10. How to use log4j2burpscanner

    main

    The tool functions as a Burp Suite plugin designed to detect CVE-2021-44228 (Log4j2 RCE) vulnerabilities. It supports both passive scanning and active scanning via DNSLog.

    Scanning Modes

    • Passive Scanning: Automatically scans traffic passing through Burp Suite.
    • Active Scanning: Uses payloads to trigger DNS requests to a configured DNSLog service.
    • Repeater Testing: To test specific requests manually in the Burp Repeater, you must enable the repeater option in the plugin dashboard.

    DNSLog Configuration

    By default, the plugin uses https://dns.xn--9tr.com/. You can customize this to use other services like ceye.io or internal intranet DNSLog APIs by configuring the following parameters in the plugin dashboard:

    • isprivatedns: Whether to use a private DNS API.
    • privatednslogurl: The internal DNSLog address.
    • privatednslogurl (response): The internal DNSLog response address.
    • isceye: Set to true if using the ceye.io API.

  11. Use Passive Scanning in Burp Suite

    main

    The plugin supports both active and passive scanning:

    • Passive Scanning: Controlled via the log4j2 Passive Scanner button. It allows for scanning individual packets.
    • Manual Trigger: You can right-click a specific request in Burp Suite and select Send to log4j2 Scanner to perform a targeted scan on that packet.

  12. Configure payload injection targets

    main

    The scanner can be configured to inject payloads into various parts of an HTTP request. Use the plugin dashboard to toggle the following:

    • Headers:
      • isContenttypeRefererOrigin: Test Content-Type, Referer, and Origin (default: off).
      • isAccept: Test Accept-Language, Accept, and Accept-Encoding (default: off).
      • isuseUserAgenttokenXff: Test User-agent, token, X-Forwarded-For, and X-Client-IP (default: on).
      • isuseXfflists: Test additional XFF lists (default: off).
    • Cookies:
      • isuseAllCookie: Test all cookies (default: on).
    • Parameters:
      • prefixparam: Add a prefix to parameters.
      • suffixparam: Add a suffix to parameters.