cosminpopescu14

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log

cosminpopescu14

using System;
using System.Collections.Generic;
using ServiceStack;
using ServiceStack.Text;
using ServiceStack.OrmLite;
using ServiceStack.OrmLite.Sqlite;
using ServiceStack.DataAnnotations;

public class User
{

cosminpopescu14

cosminpopescu14

package main

import (
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"time"
)

type Data struct {

cosminpopescu14

 Methode 1
        <p:dataTable var="entry" value="#{hashMap.entrySet().toArray()}">
            <p:column headerText="key">
                <h:outputText value="${entry.key}" />
            </p:column>

            <p:column headerText="value id">
                <h:outputText value="${entry.value.id}" />
            </p:column>
        </p:dataTable>

cosminpopescu14

#301 Redirects for .htaccess

#Redirect a single page:
Redirect 301 /pagename.php http://www.domain.com/pagename.html

#Redirect an entire site:
Redirect 301 / http://www.domain.com/

#Redirect an entire site to a sub folder
Redirect 301 / http://www.domain.com/subfolder/

cosminpopescu14

<?php

function squash($array, $prefix = '')
{
    $flat = array();
    $sep = ".";
    
    if (!is_array($array)) $array = (array)$array;
    
    foreach($array as $key => $value)

cosminpopescu14

<?php

class Log {
    public static function debug($str) {
        print "DEBUG: " . $str . "\n";
    }
    public static function info($str) {
        print "INFO: " . $str . "\n";
    }
}