Several versions of Apache Log4j are vulnerable to remote code execution (RCE). A lot of bypasses and payloads have been published; this repository aims to provide a solution that allows security teams to use all of this knowledge effectively.

With all the research done on Log4j every day, we found it important to create a consistent process that can:

• incorporate all of the techniques that were published and proven to be effective
• scale across thousands of assets
• integrate discovery techniques as quickly as they are found

So We designed a Trickest workflow. The primary input is the list of targets to check for log4j related vulnerabilities.

Trickest Workflow used:

• Get a list of payloads from this repository's payloads folder
• Add some control characters that we found useful while bypassing WAFs to each payload.
• Use an interactsh client to generate a callback URL. (Thanks ProjectDiscovery!)
• Use unfurl to insert the callback URL with a custom endpoint into each payload - this will help us correlate each hit to a target and an attack technique (Thanks tomnomnom!)
• Use thchydra to send the payloads to all targets across different services.
• Use cent to collect community nuclei templates (Thanks xm1k3!).
• Use a few custom and community nuclei templates to test using different techniques (ProjectDiscovery, thanks again!)
• Use an interactsh client to poll the URL and get a list of vulnerable hosts (Seriously ProjectDiscovery, thank you!)
• Generate the final report that contains all the results.

The workflow uses this repository as a source (soon! issue #2), so any attack payloads added to this repository will be picked up and used automatically. Check out the issues for a list of ideas that will be implemented in future versions of the workflow. README.md will be updated accordingly.

To update the techniques used you can either:

• Add string payloads to the payloads folder.
• Add nuclei templates to the custom folder.

• thchydra
• unfurl
• cent
• nuclei
• nuclei-templates