log4shell.tools Scan logs

log4shell guides & articles

17 in-depth guides on Log4Shell Tools and related topics.

Remediation & patching

Remediation & patching Log4Shell and Minecraft Servers: Check and Patch Safely Log4Shell affected Minecraft Java servers through chat messages; here is how to check and patch each version safely. 4 min read Remediation & patching Log4Shell in Third-Party Products: Checking Vendor Exposure A practical guide for defenders on checking third-party products for Log4Shell exposure and applying vendor fixes or workarounds. 3 min read Remediation & patching How to Patch Log4j Against Log4Shell: A Step-by-Step Guide A step-by-step guide to patching Log4j against Log4Shell, covering which version to upgrade to, handling transitive dependencies, verifying the fix, and avoiding regressions. 6 min read Remediation & patching Log4Shell Mitigation Without Upgrading: Stopgaps That Help A defender's guide to mitigating Log4Shell when you cannot upgrade yet, covering removing JndiLookup.class, formatMsgNoLookups, WAF limits, and why these are stopgaps rather than fixes. 6 min read

Log4Shell explained

Log4Shell explained Does Log4Shell Affect Logback, SLF4J or Spring Boot? Log4Shell (CVE-2021-44228) only affects Log4j 2 core. Logback and SLF4J are not vulnerable, but Spring Boot may be exposed if it uses Log4j 2. 3 min read Log4Shell explained How the Log4Shell JNDI Lookup RCE Worked, Conceptually A conceptual, defender-focused walkthrough of how the Log4Shell JNDI lookup led to remote code execution, explaining each link in the chain and where defenders can break it. 6 min read Log4Shell explained What Is Log4Shell? CVE-2021-44228 Explained for Defenders A defender-focused introduction to Log4Shell (CVE-2021-44228) explaining what the Log4j flaw is, which versions are affected, how the JNDI lookup worked conceptually, and the first steps to respond. 6 min read

Detecting exploitation

Detecting exploitation Signs a Log4Shell Attempt Succeeded: Post-Exploitation Checks Move from detecting Log4Shell attempts to confirming compromise with network, process, and host evidence of a successful exploit. 4 min read Detecting exploitation How to Detect Log4Shell Exploitation in Your Logs A practical guide for defenders on detecting Log4Shell exploitation attempts in existing logs, covering which fields to search, the JNDI patterns to look for, and how to triage real findings. 6 min read Detecting exploitation Triaging Log4Shell Across Your Estate With a Scanner A defender's playbook for triaging Log4Shell across a large estate, covering scanning and inventory, prioritising by exposure, confirming versions, hunting logs, and tracking remediation to closure. 6 min read

Log4j versions & CVEs

Log4j versions & CVEs How to Find Log4j in Your Dependencies (Maven, Gradle, JARs) A practical guide to locating log4j-core in your project dependencies, including transitive dependencies and shaded JARs. 3 min read Log4j versions & CVEs CVE-2021-44832: The Log4j JDBC Appender Flaw Fixed in 2.17.1 CVE-2021-44832 affects the Log4j JDBC Appender when an attacker can control the logging configuration, fixed in version 2.17.1. 3 min read Log4j versions & CVEs Is Log4j 1.x Vulnerable? CVE-2021-4104 and Other 1.x Flaws Log4j 1.x is not affected by Log4Shell but has its own unpatched CVEs. Learn about CVE-2021-4104 and migration options. 3 min read Log4j versions & CVEs CVE-2021-45046 vs 45105: The Log4Shell Follow-On Flaws A defender's comparison of CVE-2021-45046 and CVE-2021-45105, explaining why the first Log4Shell fix was incomplete, what the denial-of-service follow-up was, and why only 2.17.1 is the safe endpoint. 6 min read Log4j versions & CVEs Is My Log4j Version Vulnerable? A Defender's Checklist A defender's checklist for deciding whether a Log4j version is vulnerable, mapping version numbers to the Log4Shell CVEs and explaining how to find your true version including transitive dependencies. 6 min read Log4j versions & CVEs The Log4j Patch Timeline: Every Version and What It Fixed A defender's timeline of the Log4j patch releases, explaining what 2.15.0, 2.16.0, 2.17.0, and 2.17.1 each fixed, the 2.12.4 and 2.3.2 backports, and which version is the safe endpoint. 6 min read

Obfuscated payloads

Obfuscated payloads Obfuscated JNDI Payloads Explained for Blue Teams A defender's breakdown of how Log4Shell JNDI payloads are obfuscated, from case-folding lookups to default-value tricks and encoding, so blue teams can recognise them in logs and traffic. 5 min read