Hrafna - Log4j-Scanner for the masses

Features

• Scanning-system designed to check your own infra for vulnerable log4j-installations
• start and stop scans ([CTRL-C] is your friend), continue and skip already tested
• use your own DNS-server that listens to Requests from scanned hosts
• unique requests for each host to be scanned
• easy to correlate which host sends a callback
• reportmode to see which hosts made a callback
• adjustable fields for the payload for app-specific/customized attackpatterns

unique requests

• each payload is unique, so you can see which host triggered a response or maybe backend-system were connected

PAYLOAD: e3a4d77618a0  .  3c028d   .  l4s.scanix.edu
         ^^^              ^^^         ^^^
         host_id          scan_id     your custom nameserver

install

• install packages from requirements.txt
• instructions for the BIND-setup are below

config

• l4s.scanix.edu is our example here, change according to your own needs

• global_config

global.yaml

base_scan_domain: l4s.scanix.edu
bind_log: /var/log/bind/hrafna.log

• each scan has a unique config-file in yaml-format

scan.yaml

name: your_scan_name
mode: default
input_file: hostnames.txt

# 

• name: give your scan a name (alphanum, spaces will get converted to "_"

• mode:

  • see payloads/*.yaml for more specific payloads

  • default: (currently the only mode, but more will get added as new attackvectors are dropping in)

  • all: getting all available payloads

  • additional: currently in private mode (6 apps and counting)