Dominique RIGHETTO righettod

Objective

This gist gather a list of log4shell payloads seen on my twitter feeds.

💨 I will update it every time I see new payloads.

The goal is to allows testing detection regexes defined in protection systems.

⚠️ ⚠️ ⚠️

	#!/bin/bash
	#########################################################################################################
	# Script to identify Log4J affected class for CVE-2021-44228 in a collection of EAR/WAR/JAR files
	# Based on this script:
	# https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/identify-class-location.sh
	#########################################################################################################
	if [ "$#" -lt 1 ]; then
	script_name=$(basename "$0")
	echo "Usage:"
	echo " $script_name [BASE_SEARCH_FOLDER]"

	#!/bin/bash
	#########################################################################################################
	# Script to identify Log4J affected class for CVE-2021-44228 in a collection of jar files
	# Based on this script:
	# https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/identify-class-location.sh
	#########################################################################################################
	if [ "$#" -lt 1 ]; then
	script_name=$(basename "$0")
	echo "Usage:"
	echo " $script_name [APP_LIBS_FOLDER]"

	"""
	Script was migrated below for better evolution and consistency:
	https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/generate-report-npm.py
	"""

	package eu.righettod;

	import java.net.URI;
	import java.net.http.HttpClient;
	import java.net.http.HttpRequest;
	import java.net.http.HttpResponse;
	import java.time.Duration;
	import java.util.Arrays;
	import java.util.Locale;
	import java.util.Optional;

	name: HTTP security response headers test suites
	# TOOLS
	# VENOM HOME: https://github.com/ovh/venom
	# VENOM RELEASE: https://github.com/ovh/venom/releases
	# VENOM ASSERTION KEYWORDS: https://github.com/ovh/venom#assertion
	# REF AND RUN
	# REF BASE: https://owasp.org/www-project-secure-headers/
	# RUN CMD: venom run --var="target_site=https://righettod.eu" venom_security_headers_tests_suite.yml
	# venom run --var="target_site=https://righettod.eu" --var="internet_facing=true" venom_security_headers_tests_suite.yml
	# venom run --var="target_site=https://righettod.eu" --var="internet_facing=true" --var="logout_url=/logout" venom_security_headers_tests_suite.yml

	<?php
	//Local command to run example: "php -S localhost:8000"
	//Get optional action: login / logout / random
	$action="NA";
	if (isset($_GET["a"])) {
	$action=$_GET["a"];
	}
	switch ($action) {
	//Login action fill session and local storage dummy data
	case "login":

	name: Security authorization test suites
	# HOME: https://github.com/ovh/venom
	# TEST API: https://gorest.co.in/
	vars:
	target_host: ""
	testcases:
	- name: GetUserFromCollection
	steps:
	- type: http
	method: GET

	import uuid
	import binascii
	from datetime import datetime

	"""
	Python3 script trying to reproduce the "Sandwich Attack: A New Way Of Brute Forcing UUIDs"
	described on "https://versprite.com/blog/universally-unique-identifiers/".
	"""