Log4j overview Scanning software

January 10, 2022 · View on GitHub

This page contains an overview of any scanning software regarding the Log4j vulnerability.

NCSC-NL has not verified the scanning software listed below and therefore cannot guarantee the validity of said rules. However NCSC-NL strives to provide scanning software from reliable sources.

Vulnerability Detection

Checks if the application is vulnerable to CVE-2021-44228.

SourceNotesLinks
Canary TokensLog4Shell Vulnerability Testerhttps://canarytokens.org/generate
CrowdStrikeFree Targeted Log4j Search Toolhttps://www.crowdstrike.com/blog/free-targeted-log4j-search-tool/
crypt0janPerform a scan of a single host (using Powershell) to see if it's vulnerablehttps://github.com/crypt0jan/log4j-powershell-checker
DivertoNmap NSE scripts to check against log4shellhttps://github.com/Diverto/nse-log4shell
DtactDIVD-2021-00038 log4j scanner Scan paths including archives for vulnerable log4https://github.com/dtact/divd-2021-00038--log4j-scanner
Deepfence ThreatMapperApache v2, powerful runtime vulnerability scanner for kubernetes, virtual machines and serverlesshttps://github.com/deepfence/ThreatMapper
FullHuntOpen detection and scanning tool (Python) for discovering and fuzzing for Log4J vulnerabilityhttps://github.com/fullhunt/log4j-scan
Fox-ITA script to scan the filesystem to find Log4j2 that is vulnerable to Log4Shell (CVE-2021-44228) (Python)https://github.com/fox-it/log4j-finder
GrypeOpen source vulnerability scanner (docker), picks up nested JARs containing log4jhttps://github.com/anchore/grype
HuntressOnline Log4Shell Vulnerability Testerhttps://log4shell.huntress.com/
logpressoScans for java files that are vulnerable and may rename it for mitigationhttps://github.com/logpresso/CVE-2021-44228-Scanner
log4shell-finderFast file system scanner for log4j 1.x and 2.x vulnerabile instaces (using Python)https://github.com/HynekPetrak/log4shell-finder
Logout4shellExploits the log4shell vulnerability in order to vaccinate the vulnerable targethttps://github.com/Cybereason/Logout4Shell
Northwave SecurityNorthwave Log4j CVE-2021-44228 checker (python)https://github.com/NorthwaveSecurity/log4jcheck
Northwave SecurityNorthwave Log4j CVE-2021-44228 checker Powershell versionhttps://github.com/crypt0jan/log4j-powershell-checker
OlafHaalstraScans a list of URLs with GET or POST request with user defined parameters (python)https://github.com/OlafHaalstra/log4jcheck
ProferoSecScans network or IP address for Log4j vulnerability by making callback to scanning hosthttps://github.com/proferosec/log4jScanner
QualysLocal scanner to check for CVE-2021-4104, CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105https://github.com/Qualys/log4jscanwin
righelNmap NSE script to inject jndi payloads with customizable templates into HTTP targetshttps://github.com/righel/log4shell_nse
silentsignalLog4Shell scanner for Burp Suitehttps://github.com/silentsignal/burp-log4shell
TrendmicroOnline Log4j tester Trendmicrohttps://log4j-tester.trendmicro.com/

Log4j2 Detection

How to find

  • Java applications are distributed in Java ARchives, also known as JAR files. JAR files contain, among other things, compiled Java code in .class files.
  • The file that contains the Log4shell vulnerability (CVE-2021-44228) is: JndiLookup.class which is part of the log4j-core library.
  • There are three commonly used extensions for Java Archives: jar, war and ear. Each Java archive may contain nested archives. For example:
    • ear files often contain jar and war files
    • war files often contain jar files
    • jar files may contain other jar files
  • In order to find the vulnerable 'JndiLookup.class' file and by extension the log4j-core library, each found Java archive must be recursively scanned; meaning that nested Java archives must also be scanned.

Checks if the application or system is using Log4j2.

SourceNotesLinks
1lannScans a file or folder recursively for jar files that may be vulnerablehttps://github.com/1lann/log4shelldetect
AholzelSplunk query's to detect the used Log4j version and detect abusehttps://github.com/aholzel/log4j_splunk_querys
Crowdstrike CASTQuick scanner to walk filesystems looking for vulnerable versions of log4j (powershell)https://github.com/CrowdStrike/CAST
Devotech1Powershell: Queries domain servers and scans for log4j-core files. (slow)https://github.com/devotech/check-log4j
DIVDThis scanner will recursively scan paths including archives for vulnerable log4j versions and JndiLookup.class files.https://github.com/dtact/divd-2021-00038--log4j-scanner
ForescoutSamples of exploit attempts; The evolving Log4Shell story: analysis of ongoing and future exploitshttps://github.com/Forescout/log4j_response
GoHoyer2Bash script to detect vulnerable log4j-2 jar fileshttps://gist.github.com/gohoyer/9a40d8e0e46c4c78c99cc9d5e9adc5aa
JFrogDetects files containing vulnerable Log4j versions and also scans for locations in code where log4j 2 is called.https://github.com/jfrog/log4j-tools
Kelvin Tegelaar3Open sourced(MIT license) PowerShell log4j detection. Uses "Everything" to prevent high system loadhttps://www.cyberdrain.com/monitoring-with-powershell-detecting-log4j-files/
MergebaseDetects vulnerable Log4J versions on your file-system. It is able to find instances that are hidden several layers deep. Linux/Windows/Machttps://github.com/mergebase/log4j-detector
NCCgroupVersion hashes (MD5, SHA1 and SHA256) for log4j2 versionshttps://github.com/nccgroup/Cyber-Defence/tree/master/Intelligence/CVE-2021-44228
Neo23x04Florian Roth Log4j2 detection scripthttps://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
sp4ir5Powershell script to detect Log4Shellhttps://github.com/sp4ir/incidentresponse/blob/35a2faae8512884bcd753f0de3fa1adc6ec326ed/Get-Log4shellVuln.ps1
SyftOpen source SBOM scanner, can detect all dependencies including log4jhttps://github.com/anchore/syft/
yannartOpen sourced(MIT license) scanner to analyze recursively for jar and other Java archives that may be vulnerable (written in Rust)https://github.com/yannart/log4shell-scanner-rs

Footnotes

  1. Only scans filenames, does not search for vulnerable JndiLookup.class, does not scan nested Java archives, does not scan .war and .ear files. ↩

  2. Only scans filenames, does not scan nested Java archives, does not scan .war and .ear files. ↩

  3. Does not scan nested Java archives, does not scan .war and .ear files. ↩

  4. Windows and Linux scripts are limited and do not scan nested java archives. ↩

  5. Only scans filenames, does not scan nested Java archives, does not scan .war and .ear files. ↩