Closed chaostheory closed 2 years ago
This uses interact.sh
by default, you can use canarytoken if you want.
there are a few options here --
interact.sh
basically does this if you use the interactsh-server
I'm not sure how points 1-2 are related to this issue.
Yes, you can use CanaryToken for testing for the log4j vulnerability using another tool, but I'm not sure how it relates to Fullhunt's log4j-scan project since log4j-scan generates its own tokens. Consequently, what you have is nonsensical documentation. The CanaryToken portion should removed because it will confuse people.
@bolshoytoster CanaryTokens just generates injection tokens. Since it's not a DNS callback service, I'm not sure you can actually use it with Fullhunt's log4j-scan application.
Fullhunt's application uses interact.sh or dnslog.cn as well, if that was what you were asking.
Yes, I am aware of that. That's literally in my first comment. My question is why CanaryTokens is listed in the documentation when it seems to be completely irrelevant?
canarytokens can be used as a DNS callback service, if you click Select your token
there are plenty options, including one specific for log4j.
Ok, if canarytokens can be used as a DNS callback service, how would you use with Fullhunt's log4j-scan application? I just thought canarytokens only generated injection tokens, but I could be wrong.
If you use the --custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST
you can pass the canary tokento the script. i.e.
--custom-dns-callback-host 12u6wrag5t1a5qynqswczjglr.canarytokens.com
That was one of the first things I tried and for some odd reason it failed for me. I'll try it again. Thanks.
Did it give you an error or did it just not work?
Previously, the error I got was a 10054 error during the custom DNS Callback host portion. It works now, so it's likely user error on my part. Thanks for taking the time to answer my question
Why is CISA referencing the canarytoken service in documentation?
The reason I ask is because Fullhunt's log4j-scan, the project that CISA is referencing, doesn't need an injection token. It generates it on its own. What log4j-scan needs is a DNS callback service like interact.sh or dnslog.cn.
Did I misunderstand or miss anything?