local-log4j-vuln-scanner
Simple local scanner for vulnerable log4j instances (by hillu)
nuclei
Fast and customizable vulnerability scanner based on simple YAML based DSL. (by projectdiscovery)
| local-log4j-vuln-scanner | nuclei | |
|---|---|---|
| 10 | 17 | |
| 381 | 17,293 | |
| - | 2.2% | |
| 1.8 | 9.8 | |
| almost 2 years ago | 3 days ago | |
| Go | Go | |
| GNU General Public License v3.0 only | MIT License |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
local-log4j-vuln-scanner
Posts with mentions or reviews of local-log4j-vuln-scanner.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-01-08.
-
Log4J Network Scanning/Detection on a 100k+ Node Network
The last scanner type is looking for the classes. Carnegie Mellon’s CERTCC released one that is referenced by CISA: https://github.com/CERTCC/CVE-2021-44228_scanner that look for class names and some fingerprints. Then there is a scanner written in Go that checks for the vulnerable class files and their hashes (inside JARs, WARs,EARs, and zips). https://github.com/hillu/local-log4j-vuln-scanner
-
Log4jscanner by Google
I have been scanning with https://github.com/hillu/local-log4j-vuln-scanner and that problem was resolved in there.
-
So how exactly is Log4j supposed to be patched/mitigated on Windows?
If you want to scan your system for vulnerable log4j instances, https://github.com/hillu/local-log4j-vuln-scanner has binaries and is constantly updated
-
All log4j detection tools fail these cases - be careful
We are using this local log4j scanner: https://github.com/hillu/local-log4j-vuln-scanner/
-
Cisco AMP/Endpoint is not a great product for Endpoint Security.
https://github.com/hillu/local-log4j-vuln-scanner - Nope
- Vulnerabilidade Log4j
-
Can PDQ be used to scan for log4j usage?
Log4j may be included in other jars, so a recursive ps scan like https://github.com/hillu/local-log4j-vuln-scanner may come to rescue
-
Any mitigations in the works for the log4j critical CVE?
The scanner provided by https://github.com/hillu/local-log4j-vuln-scanner gives us the following output when using "/opt/qradar/" as directory.
- Log4j 0day being exploited
nuclei
Posts with mentions or reviews of nuclei.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-05-22.
-
The 36 tools that SaaS can use to keep their product and data safe from criminal hackers (manual research)
Nuclei
- Show HN: Oneleet – Penetration Testing for SoC 2 and beyond
-
Looking for short-term, resource intensive tasks to throw at a cloud server
If you own any web properties, you can use https://github.com/projectdiscovery/nuclei running in a beefy VM to scan them for vulnerabilities. It will scale to use all available resources if you give it a big box.
-
Pentesting Tools I Use Everyday
Learn more about nuclei here: https://nuclei.projectdiscovery.io/
-
How I found 130+ Sub-domain Takeover vulnerabilities using Nuclei
Read about how I was able to find 136 Sub-domain Takeover vulnerabilities on a Single Target using the Nuclei tool 👉👉👉Click Here - How I found 130+ Sub-domain Takeover vulnerabilities using Nuclei
-
How to develope a Network Vuln Scanner
I’d look at flan and nmap and nuclei for inspiration.
-
Thoughts on Vuln scanning public facing websites/hosts during an incident?
Had an idea to leverage the community vuln scanner Nuclei (https://nuclei.projectdiscovery.io/) to just run a quick scan against the public facing hostname/IP. The job isn't supposed to be "hey you're vulnerable to xyz, but to aid in the discovering initial access. I believe this would be considered "good faith" and you're not technically be doing anything nefarious, but wanted to get the communities thoughts on this.
- Nuclei – Community Powered Vulnerability Scanner
-
Log4J Network Scanning/Detection on a 100k+ Node Network
Check out Nuclei (https://github.com/projectdiscovery/nuclei)
What are some alternatives?
When comparing local-log4j-vuln-scanner and nuclei you can also consider the following projects:
tfsec - Security scanner for your Terraform code
jaeles - The Swiss Army knife for automated Web Application Testing
log4jscanner - A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
ZAP - The ZAP core project
CVE-2021-44228-Scanner - Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
SQLMap - Automatic SQL injection and database takeover tool
Log4jPatcher - A mitigation for CVE-2021-44228 (log4shell) that works by patching the vulnerability at runtime. (Works with any vulnerable java software, tested with java 6 and newer)
ffuf - Fast web fuzzer written in Go
nse-log4shell - Nmap NSE scripts to check against log4shell or LogJam vulnerabilities (CVE-2021-44228)
RustScan - 🤖 The Modern Port Scanner 🤖
Windowslog4jClassRemover
osmedeus - A Workflow Engine for Offensive Security
local-log4j-vuln-scanner vs tfsec
nuclei vs jaeles
local-log4j-vuln-scanner vs log4jscanner
nuclei vs ZAP
local-log4j-vuln-scanner vs CVE-2021-44228-Scanner
nuclei vs SQLMap
local-log4j-vuln-scanner vs Log4jPatcher
nuclei vs ffuf
local-log4j-vuln-scanner vs nse-log4shell
nuclei vs RustScan
local-log4j-vuln-scanner vs Windowslog4jClassRemover
nuclei vs osmedeus