commit v0.2.0

README.md

@@ -3,14 +3,17 @@
   Log4J Scanner
 </h1>
 
-<h4 align="center">Burp extension to scan Log4Shell (CVE-2021-44228) vulnerability pre and post auth.</h4>
+<h4 align="center">Burp extension to scan Log4Shell (CVE-2021-44228) vulnerability with custom payloads.</h4>
 
 ---
 
 <p align="center">
   <a href="https://github.com/0xDexter0us/Log4J-Scanner/releases">
     <img src="https://img.shields.io/github/release/0xDexter0us/Log4J-Scanner.svg">
   </a>
+  <a href="https://github.com/0xDexter0us/Log4J-Scanner/releases">
+    <img src="https://img.shields.io/github/downloads/0xDexter0us/Log4J-Scanner/total?label=downloads&logo=github&color=inactive">
+  </a>
   <a href="https://github.com/0xDexter0us/Log4J-Scanner/">
       <img src="https://img.shields.io/github/stars/0xDexter0us/Log4J-Scanner.svg?style=social&label=Stars">
   </a>
@@ -31,28 +34,25 @@
 > I am not responsible for your actions, burp-suite freezing, target getting hacked, thermonuclear war, or the current economic crisis caused by you following these directions. YOU are choosing to use this tool, and if you point your finger at me for messing anything up, I will LMAO at you.
 
 ---
-![Log4J-Scanner](https://github.com/0xDexter0us/Log4J-Scanner/images/log4j-scanner.png)
+![Usage Gif](https://github.com/0xDexter0us/Log4J-Scanner/images/useage.gif)
 
 ## Instructions:
- - Add a DNS token from any service you prefer [interact.sh](https://app.interactsh.com), [pipedream](https://pipedream.com), [canarytokens](https://canarytokens.org), [dnslog.cn](https://dnslog.cn) or burp collaborator.
- - Either select one of the pre-defined payload or add a custom payload.
- - Add custom payload as: `${jndi:ldap://[dnstoken]/[random]` as `dnstoken`and `random` are place-holders, also remember __NOT__ to add `}`closing curly bracket.
- - Select location for payload insertion, headers or parameters or both.
- - For post-auth scanning add the complete cookie, auth header. Eg: `Authorization: Bearer ya29.m.CvkBAd1XLWYfLkuHFIuOYFCfcGI137rr...`
- - Hit **Hack The Planet** button.
+ - Install the extension either from pre-compiled releases or build from source.
+ - Disable/Uncheck all other active scanning extensions like active scan++, burp bounty pro, param-miner etc.
+ - From Top-Menu open settings of Log4J Scanner.
+ - Add your custom payload and save settings.
+ - Select your target > right-click > Scan.
+ - Select `Scan Configuration` > `Select from library`
+ - Only select `Audit checks - extensions only` and hit OK button.
 
-### Important instructions to remember:
+Special thanks to [Silent Signal](https://github.com/silentsignal), instructions and scan configurations are inspired from his extension.
 
- - You'll need [Logger++](https://github.com/nccgroup/LoggerPlusPlus) or [Flow](https://github.com/hvqzao/burp-flow) extension to trace the request triggering the DNS callback.
- - Remember to add this extension above [Logger++](https://github.com/nccgroup/LoggerPlusPlus) or [Flow](https://github.com/hvqzao/burp-flow) to track all out going requests.
 
- ![Burp-Externder](https://github.com/0xDexter0us/Log4J-Scanner/images/extender.png)
-
-### How to track callbacks:
+### Important instructions to remember:
+ - In your custom payload DO __NOT__ add your collaborator url, just add `[collaborator-server]` as a placeholder,
+ - `[collaborator-server` will be replaced by your collaborator server url itself.
+ - Example payload: `"${jndi:ldap://[collaborator-server]/a}`
 
-- Payload triggering callback will contain a 6 character unique ID
-- Example payload `${jndi:ldap://example.interact.sh/ABC123` where `ABC123` will be the unique ID
-- You can search for this ID in [Logger++](https://github.com/nccgroup/LoggerPlusPlus) or [Flow](https://github.com/hvqzao/burp-flow) to trace the request.
 
 ## Download releases
 `https://github.com/0xDexter0us/Log4J-Scanner/releases/`
@@ -72,17 +72,22 @@
 ## Resources
 
 - For passive scanning: `https://github.com/f0ng/log4j2burpscanner`
-- For active scanning: `https://github.com/albinowax/ActiveScanPlusPlus`
+- For active scanning: `https://github.com/albinowax/ActiveScanPlusPlus` & `https://github.com/silentsignal/burp-log4shell`
 
 
 ## Changelog
+**25 December 2021 - v0.2.0**
+ - Added Burp Collaborator api.
+ - Removed custom scanner.
+ - Added Burp scanner api.
 
-**13 December 2021 - v.0.1.0**
+**13 December 2021 - v0.1.0**
  - First public release
 
 ## Thanks To
 
 * CoreyD97 - https://github.com/CoreyD97
+* Silent Signal - https://github.com/silentsignal
 
 
 ### This was coded be me within a day and is an initial release, bug might occur, bug reports, suggestions and pull requests all are welcome :)

build.gradle

@@ -3,7 +3,7 @@ plugins {
 }
 
 group 'com.dexter0us'
-version '0.1.0'
+version '0.2.0'
 
 repositories {
     mavenCentral()
@@ -14,8 +14,6 @@ dependencies {
     implementation 'net.portswigger.burp.extender:burp-extender-api:2.3'
     implementation 'com.miglayout:miglayout-core:5.3'   //do not update, it will break
     implementation 'com.miglayout:miglayout-swing:5.3'  //do not update, it will break
-    implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-core:1.5.2'
-    implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-swing:1.5.2'
 }
 
 task fatJar(type: Jar) {

build/kotlin/Log4JScanner010jar-classes.txt

@@ -1 +1 @@
-/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/burp/BurpExtender.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Extension$Companion.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Extension$UI.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Extension.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/GlobalsKt$console$1.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/GlobalsKt.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JScanner$scanner$job$1.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JScanner.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JTab$1$1.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JTab$actionPerformed$1.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JTab.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JTabbkp.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/ProcessResult.class
+/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/burp/BurpExtender.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Extension$Companion.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Extension.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/GlobalsKt$console$1.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/GlobalsKt.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JScanner$ScanIssue.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JScanner.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/Log4JUI.class:/home/dex/IdeaProjects/Log4J-Scanner/build/classes/kotlin/main/com/dexter0us/log4jScanner/ProcessResult.class

build/kotlin/compileKotlin/caches-jvm/lookups/counters.tab

@@ -1,2 +1,2 @@
-21
+48
 0

build/kotlin/compileKotlin/caches-jvm/lookups/lookups.tab.values.s

@@ -1 +1 @@
-��������̚̚̚
+ν™υ¬ό°χ±ζ®ΜšΜšΜšτŸήΝέΕάΘίΛν²Ο°Ο°Ο°Ο°γ²φΈπ¶Β΄ΰµρΉΝ»Ϋ»

src/main/kotlin/com/dexter0us/log4jScanner/Extension.kt

@@ -3,17 +3,20 @@ package com.dexter0us.log4jScanner
 import burp.IBurpExtender
 import burp.IBurpExtenderCallbacks
 import burp.IExtensionStateListener
-import burp.ITab
-import java.awt.Component
 import java.io.PrintWriter
+import javax.swing.*
 
 open class Extension: IBurpExtender, IExtensionStateListener {
 
     companion object{
         const val pluginName = "Log4J Scanner"
-        const val version = "0.1.0"
+        const val version = "0.2.0"
     }
 
+    private var scavUnload = false
+    private var burpMenu: JMenuBar? = null
+    private var log4jMenu: JMenu? = null
+
     override fun registerExtenderCallbacks(_callbacks: IBurpExtenderCallbacks) {
         callbacks = _callbacks
         helpers = _callbacks.helpers
@@ -22,22 +25,42 @@ open class Extension: IBurpExtender, IExtensionStateListener {
 
         callbacks.apply {
             setExtensionName(pluginName)
-            addSuiteTab(UI())
+            registerScannerCheck(Log4JScanner())
             registerExtensionStateListener { extensionUnloaded() }
         }
 
-        console("$pluginName v$version Loaded")
+        stdout.println("$pluginName v$version Loaded")
 
-    }
+        SwingUtilities.invokeLater {
+            try {
+                burpMenu = getBurpFrame()!!.jMenuBar
+                log4jMenu = JMenu("Log4J Scanner")
+                val listCustomTagsMenu = JMenuItem("Settings")
+                listCustomTagsMenu.addActionListener { Log4JUI() }
+                log4jMenu!!.add(listCustomTagsMenu)
+                burpMenu!!.add(log4jMenu)
+            } catch (e: Exception) {
+                e.printStackTrace()
+            }
+
+        }
 
-    override fun extensionUnloaded() {
-        currJob?.cancel()
-        console("Log4J scanner unloaded.")
     }
 
-    private inner class UI : ITab{
-        override fun getTabCaption(): String = "Log4J Scanner"
-        override fun getUiComponent(): Component = Log4JTab()
+    private fun getBurpFrame(): JFrame? {
+        for (frame in JFrame.getFrames()) {
+            if (frame.isVisible && frame.title.startsWith("Burp Suite")) {
+                return frame as JFrame?
+            }
+        }
+        return null
     }
 
+    override fun extensionUnloaded() {
+        currJob?.cancel()
+        stdout.println("Log4J scanner unloaded.")
+        scavUnload = true
+        burpMenu?.remove(log4jMenu)
+        burpMenu?.repaint()
+    }
 }

src/main/kotlin/com/dexter0us/log4jScanner/Globals.kt

@@ -13,6 +13,8 @@ lateinit var stderr: PrintWriter
 
 val console = { str: String -> stdout.println(str) }
 
+var initialPayload = "\${jndi:ldap://[collaborator-server]/a}"
+
 var historySize: Int = 100
 
 var currJob: Job? = null