【红队】一款无须借助dnslog的log4j2内网扫描工具

$ python3 log4j2-intranet-scan.py -husage: log4j2-intranet-scan.py [-h] [-u URL] [-c CRAW] [-p PROXY] [-l USEDLIST] [--request-type REQUEST_TYPE]                               [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]                               [--wait-time WAIT_TIME] [--waf-bypass] [--test-CVE-2021-45046] [--server SERVER]                               [--disable-http-redirects]
optional arguments:  -h, --help            show this help message and exit  -u URL, --url URL     Check a single URL. example('http://vultest.com/test.jsp')  -c CRAW, --crawler CRAW                        use crawler,any values,like 1  -p PROXY, --proxy PROXY                        send requests through proxy  -l USEDLIST, --list USEDLIST                        Check a list of URLs.  --request-type REQUEST_TYPE                        Request Type: (get, post) - [Default: get].  --headers-file HEADERS_FILE                        Headers fuzzing list - [default: headers.txt].  --run-all-tests       Run all available tests on each URL.  --exclude-user-agent-fuzzing                        Exclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.  --wait-time WAIT_TIME                        Wait time after all URLs are processed (in seconds) - [Default: 5].  --waf-bypass          Extend scans with WAF bypass payloads.  --test-CVE-2021-45046                        Test using payloads for CVE-2021-45046 (detection payloads).  --server SERVER       ldap_server  --disable-http-redirects                        Disable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have                        higher chance of reaching vulnerable systems.

log4j2 靶场：docker pull registry.cn-hangzhou.aliyuncs.com/fengxuan/log4j_vulndocker run -it -d -p 8080:8080 --name log4j_vuln_container registry.cn-hangzhou.aliyuncs.com/fengxuan/log4j_vulndocker exec -it log4j_vuln_container /bin/bash/bin/bash /home/apache-tomcat-8.5.45/bin/startup.sh

https://github.com/k3rwin/log4j2-intranet-scan