Still stuck? Head back to the log4shell home page to use the tools, or read our in-depth guides and articles.
log4shell — Frequently Asked Questions
Everything about formats, quality, privacy and how Log4Shell Tools works.
General
Frequently asked questions
Is log4shell.tools an attack tool?
No — it's purely defensive. It detects exploitation attempts and assesses versions; it does not generate or send payloads.
What does the scanner detect?
JNDI lookup payloads (${jndi:ldap://…} and obfuscated variants) consistent with CVE-2021-44228 exploitation, with the protocol and de-obfuscated form shown.
What version should I upgrade to?
Log4j 2.17.1+ for Java 8+, which fixes CVE-2021-44228, 45046 and 45105.
Log4Shell Scanner
Frequently asked questions
Does this scanner exploit or execute anything?
No. It is detection-only: it parses text, safely de-obfuscates Log4j lookup syntax, and pattern-matches. It never resolves a JNDI lookup or contacts any host.
Can it catch obfuscated payloads?
Yes — it resolves ${lower:}, ${upper:} and ${...:-default} lookup tricks to reveal hidden 'jndi' strings, so obfuscated and plain attempts both get flagged.
A payload showed up in my logs — was I hacked?
It means an attempt was logged, not that it succeeded. Success depends on whether a vulnerable Log4j version was running and outbound JNDI was possible. Check the version checker and investigate as an incident if exposed.
Is my pasted data sent anywhere?
Scanning happens server-side to analyse the text, and nothing is stored. The tool does not act on the payloads it finds.
Log4j Version Checker
Frequently asked questions
Which Log4j version is safe?
2.17.1 or later for Java 8+. It fixes CVE-2021-44228, 45046 and 45105. Backports are 2.12.4 (Java 7) and 2.3.2 (Java 6).
Is 2.15 or 2.16 safe?
Not fully. 2.15 is still exploitable via CVE-2021-45046; 2.16 fixes that but has a DoS (CVE-2021-45105). Upgrade to 2.17.1+.
Is Log4j 1.x affected?
Not by CVE-2021-44228, but 1.x is end-of-life with its own unpatched CVEs. Move to 2.17.1+.