Vulnerabilities
Confirm Log4Shell exposure with DNS callbacks
log4j-scan is a fully automated, accurate, and extensive scanner for finding hosts vulnerable to the Log4Shell log4j remote code execution flaw, fuzzing more than sixty HTTP request headers, HTTP POST data, and early HTTP response parameters across URL lists.
installgit clone https://github.com/fullhunt/log4j-scan.gitpip3 install -r requirements.txt
Python · MIT license
overview
What log4j-scan does
log4j-scan tests targets for CVE-2021-44228 (Log4Shell). It injects JNDI payloads into headers and parameters, then watches a DNS callback. A callback means a vulnerable Log4j instance resolved the payload.
Point -u at one URL or -l at a file of URLs. --run-all-tests fuzzes the full header set per host. --waf-bypass adds evasion payloads. Choose interact.sh or dnslog.cn with --dns-callback-provider, or set --custom-dns-callback-host.
Feed live hosts from a prober such as httpx, not raw discovery. Prefer log4j-scan when you need deep header fuzzing and WAF bypass for this one CVE; use nuclei when you want broader template coverage. Trickest runs it as a managed Vulnerabilities node.
use cases
Where log4j-scan fits
Confirm Log4Shell across an estate
Feed a file of live URLs and let log4j-scan inject JNDI payloads into each, confirming exposure only when a host calls back to the DNS provider.
Test through a WAF
Enable WAF-bypass payloads so the scan reaches Log4j instances sitting behind a filter that drops the standard JNDI strings.
Run every check per URL
Turn on run-all-tests to fuzz the full set of headers and request paths, catching vulnerable hosts that only parse the payload in one specific field.
Use a private callback host
Point the scan at a custom DNS callback host you control so confirmation signals land in your own infrastructure rather than a public service.
reference
log4j-scan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Check a single URL. |
| url-list | FILE | -l | Check a list of URLs, the usual pipeline input. |
| waf-bypass | BOOLEAN | --waf-bypass | Extend scans with WAF bypass payloads. |
| run-all-tests | BOOLEAN | --run-all-tests | Run every available test on each URL. |
| headers-file | FILE | --headers-file | Custom header list to fuzz with payloads. |
| dns-callback-provider | STRING | --dns-callback-provider | DNS callback provider: dnslog.cn or interact.sh (default interact.sh). |
| custom-dns-callback-host | STRING | --custom-dns-callback-host | Custom DNS callback host you control. |
| request-method | STRING | --request-type | Request type, get or post (default get). |
Showing key inputs. log4j-scan exposes 10 inputs in total.
Full flag reference (10 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Check a single URL. |
| url-list | FILE | -l | Check a list of URLs. |
| wait-time | STRING | --wait-time | Seconds to wait after all URLs are processed (default 5). |
| waf-bypass | BOOLEAN | --waf-bypass | Extend scans with WAF bypass payloads. |
| headers-file | FILE | --headers-file | Header fuzzing list. |
| run-all-tests | BOOLEAN | --run-all-tests | Run all available tests on each URL. |
| request-method | STRING | --request-type | Request type: get or post (default get). |
| dns-callback-provider | STRING | --dns-callback-provider | DNS callback provider: dnslog.cn or interact.sh (default interact.sh). |
| custom-dns-callback-host | STRING | --custom-dns-callback-host | Custom DNS callback host. |
| exclude-user-agent-fuzzing | BOOLEAN | --exclude-user-agent-fuzzing | Exclude the User-Agent header from fuzzing, useful to bypass weak User-Agent checks. |
example
Run log4j-scan
# scan a list of live URLs, fuzz every header, and add WAF-bypass payloads
python3 log4j-scan.py -l live-urls.txt --run-all-tests --waf-bypass[•] CVE-2021-44228 - Log4j RCE Scanner
[•] DNS callback: interact.sh
[•] Loaded 3 URLs from live-urls.txt
[•] URL: https://example.com | injecting JNDI payload into 15 headers
[•] URL: https://app.example.com | injecting JNDI payload into 15 headers
[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.
[!!!] Target Affected: https://app.example.com (X-Api-Version header)
[•] Scan complete: 1/3 targets vulnerable to Log4Shell.guidance
Choosing log4j-scan
Use log4j-scan when you need to confirm Log4Shell exposure on a known set of URLs. It tests one CVE, so feed it live hosts from a prober like httpx rather than raw discovery output, and enable --waf-bypass when a filter sits in front of the target.
react2shell-scanner
Same out-of-band style for the RSC/Next.js RCE. log4j-scan is the Log4j-specific equivalent.
cve-2023-3519-inspector
Fingerprints one CVE on Citrix ADC. log4j-scan is the single-CVE scanner for Log4Shell.
nuclei
Broad template library including Log4Shell. log4j-scan goes deeper on header fuzzing and WAF bypass for this one flaw.
faq
log4j-scan questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run log4j-scan yourself
A target list is probed by httpx, then log4j-scan injects JNDI payloads into the live hosts and writes the confirmed Log4Shell hits as a queryable output.
Facts on this page come from the live Trickest tool library.