fullhunt / log4j-scan

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228
MIT License
3.4k stars 741 forks source link

interact.sh server unavailable #131

Open ademighty24 opened 2 years ago

ademighty24 commented 2 years ago

HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f284db3a350>: Failed to establish a new connection: [Errno 111] Connection refused'))

hackercat3211 commented 2 years ago

A pull request has been created for this issue (https://github.com/fullhunt/log4j-scan/pull/132).

pablosnt commented 2 years ago

Same error here!

killmasta93 commented 2 years ago

currently getting the same issue docker run -it --rm -v $PWD:/data log4j-scan -l /data/urls.txt

so in this case how would i bypass? this issue?

xlocux commented 2 years ago

just change the host at line 222 to oast.fun in order to fix it.

killmasta93 commented 2 years ago

thanks for the reply, i was checking the line but not sure where to change that

image

akr3ch commented 2 years ago

change interact.sh to oast.fun.

pablosnt commented 1 year ago

Hi @mazen160, excuse me for the question, but is the fix to this problem on the roadmap?

The problem is that the interact.sh server can be only accessed by HTTP and the log4j-scan script is using HTTPS (here and here), so a timeout error occurs. You can check it here: HTTP and HTTPS.

I'm the rekono developer and I think that this tool is powerful and very useful. When I have created rekono, I include support for the cisagov tool version and now I want to replace this tool by the original one developed by you. For doing that, I need this bug to be fixed because the tool fails with the default options (only including the -u option). I think that the bug can be fixed easily, this pull request #132 created by @hackercat3211 can be a valid solution.

pablosnt commented 1 year ago

Now the domain interact.sh is not available by https neither http. The option --dns-callback-provider dnslog.cn works for me

Morpilot commented 1 year ago

so I have all .cn blocked for obvious reasons and I suspect the same for most of us here in the state. is there another option?

fdbao commented 1 year ago

specify dns callback:--dns-callback-provider dnslog.cn