Example of secure and insecure domains

[c-holtermann]

I have successfully installed the project. What is the output for a secure and an insecure domain? Is the one provided in the README ok?

[adilsoybali]

Hi @c-holtermann. In the output of the program, there is no information about whether the domain name is safe or not. If the domain is insecure, a dns echo containing the unsafe domain name will be sent to the burp collabrator or interactsh address you provided.

[c-holtermann]

Thank you! That's an important information for me that I would suggest to include in the README for people like me.

So I can go to the link you provided to interactsh, copy the link on the web interface and run the command like in the example:

./log4j-rce-scanner.sh -d adilsoybali.com -b COPIEDSTUFF.interact.sh ?

If the server is vulnerable there would be an output in the interactsh?

I think now I've understood how it works and answer my question above with yes. I've now installed a vulnerable server (https://github.com/christophetd/log4shell-vulnerable-app) which works on localhost Port 8080. I still had a bit of trouble defining the Port 8080. I had to change the list file manually. I'd suggest to also include using a specific port in the README. Using that and interactsh with this script I get a lot of responses in interactsh.

Thanks for the software!

[adilsoybali]

Hello again @c-holtermann. It has released an update on it. Thanks for your suggestion.

I wish you a good day.