safelog4j - Safelog4j is an instrumentation-based security too

项目说明

safelog4j

<p align="center"><b>
<br>
<br>
Safelog4j is an instrumentation-based security tool to help teams<br>
discover, , and sol without scanning or upgrading
<br>
<br>
</b></p>

If you're wrestling with log4shell C, the best longterm plan is to upgrade your log4j to the latest secure . But if you can't do that for whate, you probably want to be *really* sure that you have a problem and an easy way to fix it.

Safelog4j:
* accurately discovers the use of log4j
* that the log4shell is actually present and exploitable
* prevents the log4shell from being exploited

Safelog4j doesn't rely on numbers or filenames. Instead, it instruments the application to find log4j and perform an internal test to prove the app is exploitable (check). Safelog4j also uses instrumentation to disable the JNDI lookup code used by the attack (block). This is the most effective way to inoculate an otherwise application or API.

!safelog4j-screenshot

Why should you use an instrumentation-based approach to log4shell (and other security challenges)

Instrumentation has been around for decades, is widely used in performance tools, debugging and profiling, and app frameworks. Many security tools scan from the 'outside-in' and don't have the full context of the running application. This leads to false-positives, false-negatives, and long scan times.

Instrumentation allows us to do security analysis from within the running application - by watching the code run. Directly measuring security from within the running code has speed, co, and accuracy benefits. Using instrumentation to analyze for is often called IAST (Interacti Security Testing). Using instrumentation to identify attacks and prevent exploit is often called RASP (Runtime Application Self-Protection).

Safelog4j provides both IAST and RASP capabilities focused on a single : log4shell. IAST that the is present and actually exploitable. RASP prevents it from being exploited. IAST and RASP can be used for a broad range of and attacks. Please reach out if you're interested in applying these techniques to new security chaallenges.

Remember, you may be getting false results from other approaches. Scanning file systems, code repos, or containers could easily fail to detect log4j accurately. Determining exploitability by attempting to test, scan, or fuzz for log4shell is even more inaccurate, requiring exactly right input with the exactly right syntax.

* log4j could be buried in a fat jar, war, or ear
* log4j could be shaded in another jar
* log4j could be included in the appserver, not the code repo
* log4j could be part of dynamically loaded code or plugin
* log4j could be many different with different classloaders in a single app
* log4j could be masked by use of slf4j or other layers
* log4j could be renamed, recompiled, or otherwise changed

Launching a JVM with safelog4j...

Basically you just have to get the latest safelog4j-1.0.3.jar and then tell the JVM to use it with the -ja flag.

-or-

Attaching to a running JVM with safelog4j...

Safelog4j Options

* CHECK means that safelog4j will actually test every log4j instance for log4shell. This is done by generating a synthetic log message and a sensor to detect it in the JndiLookup class within log4j. This is iron clad e the application will be exploitable if the application ever logs untrusted data (HTTP header, cookie, parameter, form field, multipart, or any other source of untrusted data.

* BLOCK means that safelog4j will stub out all the methods in the log4j JndiLookup class. This is the recommended approach to ensure that log4j can't be exploited. It is harmless, except for the total pre of this attack.

* BOTH simply means that both CHECK and BLOCK will occur.

* NONE disables both CHECK and BLOCK, allowing you to keep the agent in place but completely disabled.

Building and Contributing

We welcome pull requests and issues. Thanks!

License

This software is licensed under the Apache 2 license

Copyright 2021 Contrast Security -

Licensed under the Apache License, 2.0 (the "License"); you may not use this project except in compliance with the License. You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language go permissions and limitations under the License.

项目信息

开发语言：Java

Star 数：43

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Safelog4j is an instrumentation-based security tool to help teams discover, verify, and solve log4shell vulnerabilities without scanning or upgrading展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。