log4j-scan
A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228
Installation:
sudo git clone https://github.com/fullhunt/log4j-scan.git && cd log4j-scan && sudo chmod +x * && sudo pip3 install -r requirements.txt
Scan:
Scan a Single URL using all Request Methods: GET, POST (url-encoded form), POST (JSON body)
python3 log4j-scan.py -u https://log4j.lab.secbot.local --run-all-tests
Discover WAF bypasses against the environment.
python3 log4j-scan.py -u https://log4j.lab.secbot.local --waf-bypass
Scan a list of URLs
python3 log4j-scan.py -l urls.txt