#CVE-2021
#Log4Shell
Local Bytecode Scanner for Log4JShell Vulnerability (CVE-2021-44228)

https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector

@BlueRedTeam

#CVE-2021
#Log4Shell
Simple webapp that is vulnerable to Log4Shell (CVE-2021-44228)

https://github.com/korteke/log4shell-demo

@BlueRedTeam

#CVE-2021
#Log4j
Burp extension to identify Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046

https://github.com/DXC-StrikeForce/Burp-Log4Shell-Active-Scanner

@BlueRedTeam

#CVE-2021
#Log4j
Burp Active Scan extension to identify Log4j vulnerabilities CVE-2021-44228 an CVE-2021-45046

https://github.com/freskimo/Burp-Log4j-HammerTime

@BlueRedTeam

#CVE-2021
#log4j
Simple bash noscript to scan multiples url for log4j vulnerability (CVE-2021-44228)

https://github.com/Gyrfalc0n/scanlist-log4j

@BlueRedTeam

#CVE-2021
#Log4j

A simple project to check coverage of Log4J vuln CVE-2021-44228 (and related)

https://github.com/MeterianHQ/log4j-vuln-coverage-check

@BlueRedTeam

#CVE-2021
#Log4Shell
A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

https://github.com/thomaspatzke/Log4Pot

@BlueRedTeam

#CVE-2021
#log4j2

Basic Vulnerable Spring Boot Application to Test CVE-2021-44228

https://github.com/recanavar/vuln_spring_log4j2

@BlueRedTeam

#CVE-2021
#log4j2
Scanner local em Python para localizar e identificar versões vulneráveis do Log4j2 em arquivos no disco com análise interna de arquivos JAR (CVE-2021-44228 e CVE-2021-45046)

https://github.com/andalik/log4j-scanner

@BlueRedTeam

#CVE-2021
Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

https://github.com/WazeHell/sam-the-admin

@BlueRedTeam

#CVE-2021
#log4Shell

Log4Shell CVE-2021-44228 Vulnerability Scanner and POC

https://github.com/gyaansastra/CVE-2021-44228

@BlueRedTeam

#CVE-2021
#log4j2
Scanner local em Python para varredura e localização de versões vulneráveis do Log4j2 em arquivos no disco, contemplando análise interna de arquivos JAR (CVE-2021-44228 e CVE-2021-45046)

https://github.com/andalik/log4j-filescan

@BlueRedTeam

#CVE-2021
#Log4j
Burp Active Scan extension to identify Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046

https://github.com/DXC-StrikeForce/Burp-Log4j-HammerTime

@BlueRedTeam

Apache’s Fix for Log4Shell Can Lead to DoS Attacks

Not only is the jaw-dropping flaw in the Apache Log4j logging library ubiquitous; Apache’s blanket of a quickly baked patch for Log4Shell also has holes.

https://threatpost.com/apache-patch-log4shell-log4j-dos-attacks/177064/

#Log4Shell
@PentesterReference

#CVE-2021
#Log4j
Scans for Log4j versions effected by CVE-2021-44228

https://github.com/mergebase/log4j-detector

@BlueRedTeam

#CVE-2021
#Log4j
Applications that are vulnerable to the log4j CVE-2021-44228/45046 issue may be detectable by scanning jar, war, ear, zip files to search for the presence of JndiLookup.class.

https://github.com/hozyx/log4shell

@BlueRedTeam

#CVE-2021
#Log4j
Samples of log4j library versions to help log4j scanners / detectors improve their accuracy for detecting CVE-2021-45046 and CVE-2021-44228.

https://github.com/mergebase/log4j-samples

@BlueRedTeam

#CVE-2021
#Log4Shell

Log4Shell Proof of Concept (CVE-2021-44228)

https://github.com/Kr0ff/CVE-2021-44228

@BlueRedTeam

#CVE-2021
#Log4j
#Log4Shell
Log4j - Multitool. Find & fix possible CVE-2021-44228 vulneraries - provides a complete LOG4SHELL test/attack environment

https://github.com/suuhm/log4shell4shell

@BlueRedTeam

#Exploit
1. CVE-2021-45046:
Log4j 2.15.0 stills allows for exfiltration of sensitive data
https://www.praetorian.com/blog/log4j-2-15-0-stills-allows-for-exfiltration-of-sensitive-data

2. CVE-2021-41962:
Stored XSS in Vehicle Service Management System 1.0
in Sourcecodester
https://github.com/lohyt/-CVE-2021-41962

@BlueRedTeam

#Red_Team

1. Escalate from a low-integrity Administrator account to NT AUTHORITY\SYSTEM without an LPE exploit by combining a COM UAC bypass and Token Impersonation
https://github.com/FULLSHADE/Auto-Elevate
2. AutoSUID is the project, the main idea of which is to automate harvesting the SUID executable files and to find
a way for further escalating the privileges
https://github.com/IvanGlinkin/AutoSUID

@BlueRedTeam