From the course: Ethical Hacking: The Complete Malware Analysis Process

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Understanding log4shell

Understanding log4shell

From the course: Ethical Hacking: The Complete Malware Analysis Process

Start my 1-month free trial Buy for my team

Understanding log4shell

“

- [Instructor] Apache's Log4j is a logger routine which Java developers can use to process message logs before they're archived, in order to extract and retain any information they want to keep. Log4j includes a feature called message lookup substitution, which enables specially formatted strings to be replaced at the time they're logged by dynamically generated strings. For example, logging the string, Current java:runtime will yield an output like, Current Java version 1.8.1_2. This feature can be exploited using a vulnerability known as Log4Shell, which, if exploited, allows hackers to remotely inject arbitrary code into a victim and assume complete control. To exploit the Log4j vulnerability, an attacker sends a GET request to a Java application, which includes a JNDI call to an LDAP server. JNDI is the Java Naming and Directory Interface and Java applications use it to access a variety of naming and directory…

Contents