log4shell.tools Scan logs

Log4Shell Scanner

Paste a log line, request header, or whole log file and instantly flag Log4Shell (CVE-2021-44228) exploitation attempts — including obfuscated JNDI payloads.

  • Free forever
  • No watermark
  • No signup
  1. Paste log lines, a header value, or a whole log file into the box.
  2. Click Scan — payloads are de-obfuscated and analysed locally.
  3. Review each finding: line, protocol, whether it was obfuscated, and why it's dangerous.

All log4shell tools

Log4Shell Scanner Scanner Paste a log line, request header, or whole log file and instantly flag Log4Shell (CVE-2021-44228) exploitation attempts — including obfuscated JNDI payloads. Log4j Version Checker Version Check Enter a Log4j version and find out whether it's vulnerable to Log4Shell — and exactly which fix you need.

log4shell.tools is a small set of defensive utilities for the Log4Shell vulnerability (CVE-2021-44228). The scanner flags JNDI exploitation attempts in your logs — even obfuscated ones — while the version checker tells you whether a given Log4j build is vulnerable and what to upgrade to. Detection only: nothing here executes payloads or contacts external hosts.

Below, our guides explain how Log4Shell works, how attackers obfuscate payloads, how to detect exploitation, and how to remediate for good.

Defensive by design

These tools exist to help defenders triage logs and inventory versions quickly during and after the Log4Shell crisis. They do not generate attack payloads. The scanner de-obfuscates Log4j lookup syntax purely to recognise hostile strings — it never resolves them.

From our guides

Browse all articles →
Remediation & patching Log4Shell and Minecraft Servers: Check and Patch Safely Log4Shell affected Minecraft Java servers through chat messages; here is how to check and patch each version safely. 4 min read Log4Shell explained Does Log4Shell Affect Logback, SLF4J or Spring Boot? Log4Shell (CVE-2021-44228) only affects Log4j 2 core. Logback and SLF4J are not vulnerable, but Spring Boot may be exposed if it uses Log4j 2. 3 min read Detecting exploitation Signs a Log4Shell Attempt Succeeded: Post-Exploitation Checks Move from detecting Log4Shell attempts to confirming compromise with network, process, and host evidence of a successful exploit. 4 min read Remediation & patching Log4Shell in Third-Party Products: Checking Vendor Exposure A practical guide for defenders on checking third-party products for Log4Shell exposure and applying vendor fixes or workarounds. 3 min read Log4j versions & CVEs How to Find Log4j in Your Dependencies (Maven, Gradle, JARs) A practical guide to locating log4j-core in your project dependencies, including transitive dependencies and shaded JARs. 3 min read Log4j versions & CVEs CVE-2021-44832: The Log4j JDBC Appender Flaw Fixed in 2.17.1 CVE-2021-44832 affects the Log4j JDBC Appender when an attacker can control the logging configuration, fixed in version 2.17.1. 3 min read Log4j versions & CVEs Is Log4j 1.x Vulnerable? CVE-2021-4104 and Other 1.x Flaws Log4j 1.x is not affected by Log4Shell but has its own unpatched CVEs. Learn about CVE-2021-4104 and migration options. 3 min read Log4j versions & CVEs CVE-2021-45046 vs 45105: The Log4Shell Follow-On Flaws A defender's comparison of CVE-2021-45046 and CVE-2021-45105, explaining why the first Log4Shell fix was incomplete, what the denial-of-service follow-up was, and why only 2.17.1 is the safe endpoint. 6 min read

Frequently asked questions

Is log4shell.tools an attack tool?
No — it's purely defensive. It detects exploitation attempts and assesses versions; it does not generate or send payloads.
What does the scanner detect?
JNDI lookup payloads (${jndi:ldap://…} and obfuscated variants) consistent with CVE-2021-44228 exploitation, with the protocol and de-obfuscated form shown.
What version should I upgrade to?
Log4j 2.17.1+ for Java 8+, which fixes CVE-2021-44228, 45046 and 45105.