Skip to content
/ log4j Public

Trickest Workflow for discovering log4j vulnerabilities and gathering the newest community payloads.

License

Notifications You must be signed in to change notification settings

trickest/log4j

Repository files navigation

Trickest Log4j

Several versions of Apache Log4j are vulnerable to remote code execution (RCE). A lot of bypasses and payloads have been published; this repository aims to provide a solution that allows security teams to use all of this knowledge effectively.

Motivation

With all the research done on Log4j every day, we found it important to create a consistent process that can:

  • incorporate all of the techniques that were published and proven to be effective
  • scale across thousands of assets
  • integrate discovery techniques as quickly as they are found

So We designed a Trickest workflow. The primary input is the list of targets to check for log4j related vulnerabilities.

How it works

Trickest Workflow used:

Log4jWorkflow

TB; DZ (Too big; didn't zoom):

  • Get a list of payloads from this repository's payloads folder
  • Add some control characters that we found useful while bypassing WAFs to each payload.
  • Use an interactsh client to generate a callback URL. (Thanks ProjectDiscovery!)
  • Use unfurl to insert the callback URL with a custom endpoint into each payload - this will help us correlate each hit to a target and an attack technique (Thanks tomnomnom!)
  • Use thchydra to send the payloads to all targets across different services.
  • Use cent to collect community nuclei templates (Thanks xm1k3!).
  • Use a few custom and community nuclei templates to test using different techniques (ProjectDiscovery, thanks again!)
  • Use an interactsh client to poll the URL and get a list of vulnerable hosts (Seriously ProjectDiscovery, thank you!)
  • Generate the final report that contains all the results.

How to Update

The workflow uses this repository as a source, so any attack payloads added to this repository will be picked up and used automatically. Check out the issues for a list of ideas that will be implemented in future versions of the workflow. README.md will be updated accordingly.

To update the techniques used you can either:

  • Add string payloads to the payloads folder.
  • Add nuclei templates to the custom folder.

Resources