Log4JHunt - An automated, reliable scanner for the Log4Shell (

项目说明

Log4JHunt

An automated, reliable scanner for the Log4Shell C .

Video demo:

![video]()

Usage

Here the help usage:

#### Getting a token
The tool makes use of Log4Shell tokens from Canary Tokens. The tool has capability to automatically generate tokens, if the of the token (--token) and server (--server) are empty.

Once the token is generated, the token and the auth value are written to a file called canary-token.json.

#### Targets specification
You can specify the targets in two modes:

Scan a single URL:

Use a file to specify a list of targets:

#### Specifying notification channels
There are two ways in which you can recei channels:

email (--email) -- service provided by Canarytokens.

webhook (--webhook) -- service provided by Canarytokens.

custom server (--server) -- you own custom DNS callback server.

Once the tool finds a server, notifications would be relayed back to your preferred communication channel.

#### Sending requests

You can customize the HTTP methods using --methods.

A custom set of HTTP headers can be specified via --headers respectively.

A custom user agent can be specified using --user-agent header.

You can specfy a custom timeout value using --timeout.

You can specify custom proxies to use in HTTP requests via --proxy.

#### Specifying delay

Since a lot of HTTP requests are in, it might be a cumbersome job for the remote host to handle the requests. The --delay parameter is here to help you with those cases. You can specify a delay value in seconds -- which will be used be used in between two subsequent requests to the same port on a server.

#### More details around the Log4J
We ha more details around Log4j in our Blog.

License &

The tool is licensed under the MIT license. See LICENSE.

Currently the tool is at v0.1.

Credits

The Research Team at RedHunt Labs would like to thank Thinkst Canary for the awesome Canary Token Project.

To know more about our Attack Surface Management platform, check out NVADR.

项目信息

开发语言：Python

Star 数：47

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。