CVE-2021-44228 (log4shell) POC

---

log4j Scanning tool

This tool will help you identify remote code execution vulnerability (log4j) on your systems.

Requirements

You will need to install httpx, subfinder, assetfinder, curl and amass in order to run the bash script.

Installation

1. Simply git clone the repo or download the bash script git clone https://github.com/shamo0/CVE-2021-44228.git
2. change file permissions chmod +x log4j_scanner.sh
3. Run the bash script ./log4j_scanner.sh

Usage:

./log4j_scanner.sh -l subdomains.txt -i c6wvp482vtc10xx5bhnggdqp5neyyyyyb.interact.sh
./log4j_scanner.sh -d vulnsite.com -i c6wvp482vtc10xx5bhnggdqp5neyyyyyb.interact.sh

-h, --help Help menu
-l, --url-list List of domain/subdomain/ip to be used for scanning.
-d, --domain The domain name to which all subdomains and itself will be checked with Subfinder & Assetfinder.
-i, --inteactshdomain interactsh domain address.

References & Acknowledgements

• https://log4shell.huntress.com/
• https://github.com/adilsoybali/Log4j-RCE-Scanner
• https://nvd.nist.gov/vuln/detail/CVE-2021-44228

But also please note that