Remote CVE-2021-44228 Apache log4j RCE

[Lipshitz]

Another attack surface has been discovered. This article is about exploiting the log4j flaw with malicious code hosted on a website, such as a watering hole attack.

New Local Attack Vector Expands the Attack Surface of Log4j Vulnerability

A new local attack vector just expanded the attack surface of critical Log4j vulnerability.

thehackernews.com

 

[ev4ng3liya]

A Detailed Guide on Log4J Penetration Testing

A Detailed Guide on Log4J Penetration Testing

In this article, we are going to discuss and demonstrate in our lab setup, the exploitation of the new vulnerability identified as CVE-2021-44228 affecting the

www.hackingarticles.in

 

[987skeet]

A few more WAF bypasses available here, and maybe also take a look at the log4j-payload-generator plugin for Woodpecker. So many skilled hackers in China

 

[Абхазия_сумерки]

A Detailed Guide on Log4J Penetration Testing

A Detailed Guide on Log4J Penetration Testing

In this article, we are going to discuss and demonstrate in our lab setup, the exploitation of the new vulnerability identified as CVE-2021-44228 affecting the

www.hackingarticles.in

ссылка запорченно

 

[ev4ng3liya]

ссылка запорченно

На web[.]archive[.]org ищи.

 

[Prokhorenco]

Log4J Cheat Sheet

 

[xanthopsia]

Log4J Cheat Sheet

Bug Bounty Tip
:: Log4j Vulnerability Cheatsheet

🔹 How It Works
🔹 Test Environments
🔹 Challenges & Labs (Rooms)
🔹 Where Payloads can be Injected
🔹 What Information can be Extracted
🔹 How To Identify (Services & Scanners) pic.twitter.com/IV2FdFD2g2

— Anton (@therceman) December 14, 2021

Посмотреть вложение 65954

Is it really still relevant?

 

[Prokhorenco]

Is it really still relevant?

It's still kicking around the last time i ran a simple scan: http://xssforum7mmh3n56inuf2h73hvhnzobi7h2ytb3gvklrfqm7ut3xdnyd.onion/threads/83679/

 

[Lipshitz]

Seems it's still interesting to some people

Critical Apache Log4j2 flaw still threatens global finance - Security Affairs

The flaw CVE-2021-44832 is Apache Log4j2 library is still a serious problem for multiple industries, experts warn it threatens global Finance.

securityaffairs.com

 

[Kratosnew]

How can I find a FOFA dork to find faster this type of error or another? Or if there is a page that provides a FOFA dork for CVE, I would appreciate a solution. Thanks

 

[shrekushka]