tangxiaofeng7/burplog4j2scan

Burpsuite extension for log4j2rce

BurpLog4j2Scan

Description

BurpLog4j2Scan is a Burp Suite Extension written in JAVA which could be useful as scan log4j2rce.

Screenshot

start scan

process

result

Link

https://github.com/Maskhe/FastjsonScan

https://github.com/whwlsfb/Log4j2Scan

burplog4j2scan's Issues

师傅这个是不支持get请求里面的url参数嘛

靶场一：https://github.com/vulhub/vulhub/tree/master/log4j/CVE-2021-44228
靶场二：是你图片里面的那套

靶场一没扫出来漏洞

After Installing BurpExtender.java But not showing.

Dear Sir,

After installing BurpExtender.java its shows shiroscan tab

https://i.imgur.com/n4ywywV.png

but not showing this:

Extensions->BurpLog4j2-scan->Send to Log4jScan

https://i.imgur.com/xzzGW8e.png.

How you tell how to install this BurpLog4j2Scan.?

Thanks

Issue when importing plugin

java.lang.ClassNotFoundException: burp.BurpExtender
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:471)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:589)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:398)
at burp.avu.a(Unknown Source)
at burp.avu.(Unknown Source)
at burp.co7.a(Unknown Source)
at burp.d_u.lambda$panelLoaded$0(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)

Scanning doesn't finish.

I installed BurpLog4j2Scan but scanning doesn't finish.
How do I do?

https://imgur.com/DMszCxM

Errors when I load extension in Burp

Not working...
OS - kali linux 2021.4
My Burp Suite Community Edition - v2021.10.3
Installed JAVA on my PC:
openjdk version "11.0.13" 2021-10-19
OpenJDK Runtime Environment (build 11.0.13+8-post-Debian-1)
OpenJDK 64-Bit Server VM (build 11.0.13+8-post-Debian-1, mixed mode, sharing)

javac 11.0.13

When I go to Extender -> Extensions -> Add -> Load gradle-wrapper.jar and then appear errors:

java.lang.ClassNotFoundException: burp.BurpExtender
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:476)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:589)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:398)
at burp.am4.a(Unknown Source)
at burp.am4.(Unknown Source)
at burp.c04.a(Unknown Source)
at burp.h14.lambda$panelLoaded$0(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)

How can I compile this extension?
There is no file - pom.xml - in your directories of BurpLog4j2Scan-master...

1.8jdk的burp好像不能使用这个插件