Yet another log4j vulnerability scanner

k-amon-k - Yet another log4j scanner

Quick-n-Dirty installation

Assuming you have a working Go installation in your *NIX

  • git clone [email protected]:thanasisk/k-amon-k.git
  • go get golang.org/x/sys/unix
  • go build
  • ./k-amon-k foo.war

Releases etc coming

FAQ

  • What's with the name?
  • I really like this band, if you are into metal music, make sure to support them
  • How does it work?
  • At the time of writing, log4j 2.0.17 is considered the only safe version, thus the only good known SHA256. The utility contains known BAD SHA256s for known vulnerable versions.
  • Does it support nested Zips/Jars etc?
  • Yes!
  • Is it not MD5, that "competing" implementations use,considered broken from a security perspective?
  • Yes and indeed it is. While an attack is might not be practical, let's use SHA256.
  • Where has this been tested on?
  • Why, Linux only of course.

License

GPL v3

Owner
Athanasios Kostopoulos
Cloud Security Engineer in Berlin, Germany
Athanasios Kostopoulos
https://github.com/thanasisk/k-amon-k
Similar Resources

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

Vuls: VULnerability Scanner Vulnerability scanner for Linux/FreeBSD, agent-less, written in Go. We have a slack team. Join slack team Twitter: @vuls_e

Jan 9, 2023

Super Java Vulnerability Scanner

Super Java Vulnerability Scanner

XiuScan 不完善，正在开发中 介绍 一个纯Golang编写基于命令行的Java框架漏洞扫描工具 致力于参考xray打造一款高效方便的漏扫神器 计划支持Fastjson、Shiro、Struts2、Spring、WebLogic等框架 PS: 取名为XiuScan因为带我入安全的大哥是修君 特点

Dec 30, 2021

A vulnerability scanner for container images and filesystems

A vulnerability scanner for container images and filesystems

A vulnerability scanner for container images and filesystems

Jan 1, 2023

log4jshell vulnerability scanner for bug bounty

log4jshell vulnerability scanner for bug bounty

log4shell-looker a log4jshell vulnerability scanner for bug bounty (Written in G

Dec 10, 2022

A vulnerability scanner for container images and filesystems

A vulnerability scanner for container images and filesystems

A vulnerability scanner for container images and filesystems. Easily install the

Dec 24, 2021

Gbu-scanner - Go Blog Updates (Scanner service)

Go Blog Updates - Scanner This service scans go blog (go.dev) and publishes new posts to message broker (rabbitmq). It uses mongodb as a storage for a

Jan 10, 2022

GONET-Scanner - Golang network scanner with arp discovery and own parser

GONET-Scanner - Golang network scanner with arp discovery and own parser

GO/NET Scanner ScreenShots Install chmod +x install.sh ./install.sh [as root] U

Dec 11, 2022

Not Yet Another Password Manager written in Go using libsodium

secrets Secure and simple passwords manager written in Go. It aims to be NYAPM (Not Yet Another Password Manager), but tries to be different from othe

May 30, 2022

Another JS scanner but in Go

Another JS scanner but in Go

NipeJS Read list of JS files and look for sensitive data via regex. ☕ Install go get github.com/i5nipe/nipejs ☕ Regular expressions Download the file

Nov 9, 2022
Related tags
Security security log4shell
Scanner to send specially crafted requests and catch callbacks of systems that are impacted by Log4J Log4Shell vulnerability (CVE-2021-44228)

scan4log4shell Scanner to send specially crafted requests and catch callbacks of systems that are impacted by Log4J Log4Shell vulnerability CVE-2021-4

Sep 17, 2022
WhiteSource Log4j Detect is a free CLI tool that quickly scans your projects to find vulnerable Log4j versions

Log4jDetect WhiteSource Log4j Detect is a free CLI tool that quickly scans your projects to find vulnerable Log4j versions containing the following kn

Nov 20, 2022
Scans and catches callbacks of systems that are impacted by Log4J Log4Shell vulnerability across specific headers.
 Scans and catches callbacks of systems that are impacted by Log4J Log4Shell vulnerability across specific headers.

Log4ShellScanner Scans and catches callbacks of systems that are impacted by Log4J Log4Shell vulnerability across specific headers. Very Beta Warning!

Jun 17, 2022
Tool to check whether one of your applications is affected by a vulnerability in log4j: CVE-2021-44228
 Tool to check whether one of your applications is affected by a vulnerability in log4j: CVE-2021-44228

log4shell.tools log4shell.tools is a tool allows you to run a test to check whether one of your applications is affected by a vulnerability in log4j:

Nov 2, 2022
Detect and fix log4j log4shell vulnerability (CVE-2021-44228)

log4fix This tool is to detect and fix the log4j log4shell vulnerability (CVE-2021-44228) by looking and removing the JndiLookup class from .jar/.war/

Sep 22, 2022
Simple local scanner for vulnerable log4j instances

Simple local log4j vulnerability scanner (Written in Go because, you know, "write once, run anywhere.") This is a simple tool that can be used to find

Dec 21, 2022
Divd 2021 00038 log4j scanner

divd-2021-00038--log4j-scanner This scanner will recursively scan paths including archives for vulnerable log4j versions and org/apache/logging/log4j/

Nov 9, 2022
Just simple log4j scanner With Golang
 Just simple log4j scanner With Golang

Summary Yesterdy which is Decemeber 12, 2021. One of my friend send me a message on twitter that he want me to write a script that brute force list of

Dec 26, 2022
Log4j-scanner tools - Support for multiple scan method

Log4j-scanner URL mode (fuzzing url with header, payload) go run . url -h Usage

Sep 7, 2022
A Smart Log4Shell/Log4j/CVE-2021-44228 Scanner

Log4Shell Sentinel - A Smart CVE-2021-44228 Scanner Introduction While there have some excellent tools released to help organizations scan their envir

Oct 29, 2022