Releases: f0ng/log4j2burpscanner
0.16.8 update
how to use? releases download the latest plugin
0.16.8更新
2021-12-18
1.A prompt is added on the success page, and the dnslog address displays information
2.Repair the $ problem of 0.16.7, #27
1.success页面增加提示，dnslog地址显示信息，感谢@0cat-r 师傅
2.修复0.16.7的$问题，#27 感谢@heiha7789 师傅
Contributors
Assets 3
0.16.7 update
how to use? releases download the latest plugin
0.16.7更新
2021-12-17
- Optimize the whitelist settings. The default is (
*. gov.cn,*. edu. cn). Wildcards are used to determine the domain name suffix, or they can be accurate to a site, such as (www.baidu.com) - Without parameters, add payload directly after the path
- Optimize the payload. In testing some systems, it is found that the
$will cause the request not to be parsed. Specifically, this kind of situation can be found in a remote A8 system on the intranet. However, in the intranet VMware test, it is found that if the URL encoding of$in the content type will not trigger a leak, so the following changes are added, The$in the request header carried by the header in the normal URI request is encoded, while the $in the request header carried by the header in the payload URI request header is not encoded - Set the dnslog drawing
- The initial processing of the static resources of the requested URI is not perfect, resulting in some intranet requests, such as JSON is not scanned, so this update optimizes the previous code and adds a static resource blacklist
1.优化白名单设置，默认(*.gov.cn、*.edu.cn) ，使用通配符来确定域名后缀，也可以精确到某站点，如 (www.baidu.com) 等
2.无参情况，直接在路径后面添加payload，感谢D师傅
3.对payload进行优化，在测试某些系统中发现，$符号会造成请求不解析，具体可以在内网某远A8系统找到该类情况，但是由于在内网VMWARE测试发现，如果Content-type中的$进行url编码，会触发不了漏洞，故增加改动如下，正常uri请求中header携带的请求头中的$进行编码处理，payload的uri请求头中header携带的请求头中的$不进行编码处理，感谢@Chinakentgao 师傅
4.对dnslog进行配图设置，感谢@wuxiaodai 师傅
5.由于对请求的uri的静态资源一开始处理的不完善，导致出现对一些内网的请求如.json不进行扫描，故该更新对之前的代码进行优化，添加静态资源黑名单，感谢团队的师傅
Contributors
Assets 3
0.16.6 update
how to use? releases download the latest plugin
2021-12-16
0.16.6 update
#23 thx @k-fire
A request is added because the parameters in some URIs may be routing parameters, so a normal URI is added, but the request carrying other headers payload
增加一个请求，原因为某些uri里的参数可能为路由参数，所以增加一个正常uri，但是携带其他headers头payload的请求
Contributors
Assets 3
0.16.5.1 update
0.16.5 update
0.16.5 update
2021-12-15
1.add white lists
2.If get has no parameters, add payload directly later
optimization
If there is no parameter, the parameter will not be tested if it is selected for testing (except for common XFF headers and if-modified since, cause: there are many triggers). Thank Master @ K-fire for your feedback
Fix parameter problem
zh-CN:
1.自定义白名单，默认(.gov.cn、.edu.cn)
2.GET无参情况，直接在后面添加payload
优化
如果没有参数，选中测试该参数，那么也将不会测试（常用XFF头、If-Modified-Since除外，原因：触发较多），感谢@k-fire 师傅反馈
修复
修复isip参数问题
