CVE-2021-44228_scanner
nuclei
CVE-2021-44228_scanner | nuclei | |
---|---|---|
13 | 17 | |
346 | 17,361 | |
0.0% | 2.6% | |
1.8 | 9.8 | |
about 2 years ago | 7 days ago | |
PowerShell | Go | |
BSD 2-clause "Simplified" License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
CVE-2021-44228_scanner
- Bitcoin miner support/suggestions (log4j)
- Log4J Scanner via Ninja
- Log4 detection by enterprise tools
-
Log4J Network Scanning/Detection on a 100k+ Node Network
The last scanner type is looking for the classes. Carnegie Mellonโs CERTCC released one that is referenced by CISA: https://github.com/CERTCC/CVE-2021-44228_scanner that look for class names and some fingerprints. Then there is a scanner written in Go that checks for the vulnerable class files and their hashes (inside JARs, WARs,EARs, and zips). https://github.com/hillu/local-log4j-vuln-scanner
- Any free tool to scan for Log4Shell and Log4j vulnerabilities?
- Log4j vulnerability mitigation
-
Is Log4J really fixed?
See: https://github.com/CERTCC/CVE-2021-44228_scanner
-
Add CERTCC log4j scan to PDQ?
I'd like to use this to this script scan our network for log4j vulnberabilties: https://github.com/CERTCC/CVE-2021-44228_scanner
- Log4J "JndiLookup.class" question
- Is my Powershell Log4J scanner sufficient?
nuclei
-
The 36 tools that SaaS can use to keep their product and data safe from criminal hackers (manual research)
Nuclei
- Show HN: Oneleet โ Penetration Testing for SoC 2 and beyond
-
Looking for short-term, resource intensive tasks to throw at a cloud server
If you own any web properties, you can use https://github.com/projectdiscovery/nuclei running in a beefy VM to scan them for vulnerabilities. It will scale to use all available resources if you give it a big box.
-
Pentesting Tools I Use Everyday
Learn more about nuclei here: https://nuclei.projectdiscovery.io/
-
How I found 130+ Sub-domain Takeover vulnerabilities using Nuclei
Read about how I was able to find 136 Sub-domain Takeover vulnerabilities on a Single Target using the Nuclei tool ๐๐๐Click Here - How I found 130+ Sub-domain Takeover vulnerabilities using Nuclei
-
How to develope a Network Vuln Scanner
Iโd look at flan and nmap and nuclei for inspiration.
-
Thoughts on Vuln scanning public facing websites/hosts during an incident?
Had an idea to leverage the community vuln scanner Nuclei (https://nuclei.projectdiscovery.io/) to just run a quick scan against the public facing hostname/IP. The job isn't supposed to be "hey you're vulnerable to xyz, but to aid in the discovering initial access. I believe this would be considered "good faith" and you're not technically be doing anything nefarious, but wanted to get the communities thoughts on this.
- Nuclei โ Community Powered Vulnerability Scanner
-
Log4J Network Scanning/Detection on a 100k+ Node Network
Check out Nuclei (https://github.com/projectdiscovery/nuclei)
What are some alternatives?
hotpatch-for-apache-log4j2 - An agent to hotpatch the log4j RCE from CVE-2021-44228.
jaeles - The Swiss Army knife for automated Web Application Testing
CVE-2021-44228-Log4Shell-Hashes - Hashes for vulnerable LOG4J versions
ZAP - The ZAP core project
Get-log4j-Windows.ps1 - Identifying all log4j components across all windows servers, entire domain, can be multi domain. CVE-2021-44228
SQLMap - Automatic SQL injection and database takeover tool
local-log4j-vuln-scanner - Simple local scanner for vulnerable log4j instances
ffuf - Fast web fuzzer written in Go
log4shell - Operational information regarding the log4shell vulnerabilities in the Log4j logging library.
RustScan - ๐ค The Modern Port Scanner ๐ค
log4shell-detector - Detector for Log4Shell exploitation attempts
osmedeus - A Workflow Engine for Offensive Security