loading
Loading content
loading
Vulnerabilities
Remote scanner for Log4Shell RCE, CVE-2021-44228.
overview
log4j-scan tests targets for CVE-2021-44228 (Log4Shell). It injects JNDI payloads into headers and parameters, then watches a DNS callback. A callback means a vulnerable Log4j instance resolved the payload.
Point -u at one URL or -l at a file of URLs. --run-all-tests fuzzes the full header set per host. --waf-bypass adds evasion payloads. Choose interact.sh or dnslog.cn with --dns-callback-provider, or set --custom-dns-callback-host.
Feed live hosts from a prober such as httpx, not raw discovery. Prefer log4j-scan when you need deep header fuzzing and WAF bypass for this one CVE; use nuclei when you want broader template coverage. Trickest runs it as a managed Vulnerabilities node.
use cases
Feed a file of live URLs and let log4j-scan inject JNDI payloads into each, confirming exposure only when a host calls back to the DNS provider.
Enable WAF-bypass payloads so the scan reaches Log4j instances sitting behind a filter that drops the standard JNDI strings.
Turn on run-all-tests to fuzz the full set of headers and request paths, catching vulnerable hosts that only parse the payload in one specific field.
Point the scan at a custom DNS callback host you control so confirmation signals land in your own infrastructure rather than a public service.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Check a single URL. |
| url-list | FILE | -l | Check a list of URLs, the usual pipeline input. |
| waf-bypass | BOOLEAN | --waf-bypass | Extend scans with WAF bypass payloads. |
| run-all-tests | BOOLEAN | --run-all-tests | Run every available test on each URL. |
| headers-file | FILE | --headers-file | Custom header list to fuzz with payloads. |
| dns-callback-provider | STRING | --dns-callback-provider | DNS callback provider: dnslog.cn or interact.sh (default interact.sh). |
| custom-dns-callback-host | STRING | --custom-dns-callback-host | Custom DNS callback host you control. |
| request-method | STRING | --request-type | Request type, get or post (default get). |
Showing key inputs. log4j-scan exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Check a single URL. |
| url-list | FILE | -l | Check a list of URLs. |
| wait-time | STRING | --wait-time | Seconds to wait after all URLs are processed (default 5). |
| waf-bypass | BOOLEAN | --waf-bypass | Extend scans with WAF bypass payloads. |
| headers-file | FILE | --headers-file | Header fuzzing list. |
| run-all-tests | BOOLEAN | --run-all-tests | Run all available tests on each URL. |
| request-method | STRING | --request-type | Request type: get or post (default get). |
| dns-callback-provider | STRING | --dns-callback-provider | DNS callback provider: dnslog.cn or interact.sh (default interact.sh). |
| custom-dns-callback-host | STRING | --custom-dns-callback-host | Custom DNS callback host. |
| exclude-user-agent-fuzzing | BOOLEAN | --exclude-user-agent-fuzzing | Exclude the User-Agent header from fuzzing, useful to bypass weak User-Agent checks. |
example
# scan a list of live URLs, fuzz every header, and add WAF-bypass payloadspython3 log4j-scan.py -l live-urls.txt --run-all-tests --waf-bypass[•] CVE-2021-44228 - Log4j RCE Scanner[•] DNS callback: interact.sh[•] Loaded 3 URLs from live-urls.txt[•] URL: https://example.com | injecting JNDI payload into 15 headers[•] URL: https://app.example.com | injecting JNDI payload into 15 headers[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.[!!!] Target Affected: https://app.example.com (X-Api-Version header)[•] Scan complete: 1/3 targets vulnerable to Log4Shell.guidance
Use log4j-scan when you need to confirm Log4Shell exposure on a known set of URLs. It tests one CVE, so feed it live hosts from a prober like httpx rather than raw discovery output, and enable --waf-bypass when a filter sits in front of the target.
Same out-of-band style for the RSC/Next.js RCE. log4j-scan is the Log4j-specific equivalent.
Fingerprints one CVE on Citrix ADC. log4j-scan is the single-CVE scanner for Log4Shell.
Broad template library including Log4Shell. log4j-scan goes deeper on header fuzzing and WAF bypass for this one flaw.
faq
related
Automates OS command injection detection and exploitation.
Parameter mining and XSS testing with headless verification.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
A target list is probed by httpx, then log4j-scan injects JNDI payloads into the live hosts and writes the confirmed Log4Shell hits as a queryable output.
Facts on this page come from the live Trickest tool library.