Several versions of Apache Log4j are vulnerable to remote code execution (RCE). A lot of bypasses and payloads have been published; this repository aims to provide a solution that allows security teams to use all of this knowledge effectively.
With all the research done on Log4j every day, we found it important to create a consistent process that can:
- incorporate all of the techniques that were published and proven to be effective
- scale across thousands of assets
- integrate discovery techniques as quickly as they are found
So We designed a Trickest workflow. The primary input is the list of targets to check for log4j related vulnerabilities.
Trickest Workflow used:
- Get a list of payloads from this repository's
payloadsfolder - Add some control characters that we found useful while bypassing WAFs to each payload.
- Use an interactsh client to generate a callback URL. (Thanks ProjectDiscovery!)
- Use unfurl to insert the callback URL with a custom endpoint into each payload - this will help us correlate each hit to a target and an attack technique (Thanks tomnomnom!)
- Use thchydra to send the payloads to all targets across different services.
- Use cent to collect community nuclei templates (Thanks xm1k3!).
- Use a few custom and community nuclei templates to test using different techniques (ProjectDiscovery, thanks again!)
- Use an interactsh client to poll the URL and get a list of vulnerable hosts (Seriously ProjectDiscovery, thank you!)
- Generate the final report that contains all the results.
The workflow uses this repository as a source (soon! issue #2), so any attack payloads added to this repository will be picked up and used automatically. Check out the issues for a list of ideas that will be implemented in future versions of the workflow. README.md will be updated accordingly.
To update the techniques used you can either:
- Add string payloads to the
payloadsfolder. - Add nuclei templates to the
customfolder.