Table of Contents
  • Home
  • /
  • Blog
  • /
  • 4 Powerful Tools To Check For Vulnerable Log4j Hosts
January 4, 2022

4 Powerful Tools To Check For Vulnerable Log4j Hosts

4 Powerful Tools To Check For Vulnerable Log4j Hosts

Log4j has seen a series of vulnerabilities discloser just over the period of a couple of weeks. The worst part is that it is said to be the deadliest vulnerability of the decade. Security firm CheckPoint said that these vulnerabilities are not less than a pandemic. These vulnerabilities allow attackers to perform unauthenticated, remote code execution with minimum effort on any application using the Log4j library. We hope most of you know how many applications use the Log4j library. This made millions of machines vulnerable to the Log4j vulnerabilities. If you want to read more on the Log4j vulnerabilities, we have published multiple posts on how to detect Log4j vulnerabilities, how to fix Log4j vulnerabilities, how to protect your machine from Log4j vulnerabilitieshow do Log4j vulnerabilities work, and some of the basic workaround techniques to mitigate Log4j vulnerabilities in previous posts. We thought it is good to introduce some more tools and techniques to help you check the vulnerable hosts more efficiently. Please don’t leave this post unread, as we have covered four new powerful tools to check for vulnerable log4j hosts on your network.

If you are searching for a command to check the Log4j version, then you may end up with no results. There is no such command that will tell you the version of Log4j installed on your system. Some applications ship the libraries directly as a jar file, and some will contain them in archives. You may need to prep inside the jar or archive to see the version of Log4j.

Well, it is easy for a java developer who knows how to prepare jar files and build java packages to check the Log4j library versions inside jar files. However, we have created this post for those who don’t know about looking for Log4j library versions hidden inside jar files. We have covered four such powerful tools to check for vulnerable log4j hosts on your network.

Log4j Vulnerabilities Found In 2021:

ulnerabilityCVSSDescriptionFixed In
CVE-2021-4422810.0 CriticalUnauthenticated Remote Code Execution vulnerability in Log4j Logging Library2.15.0
CVE-2021-450463.7 LowDenial of Service vulnerability in Log4j Logging Library2.16.0
CVE-2021-451057.5 HighDenial of Service vulnerability in Log4j Logging Library due to infinite recursion in lookup evaluation2.17.0
CVE-2021-448326.6 MediumRCE vulnerability could allow attackers to modify the logging configuration file to execute code via a data source referencing a JNDI URI.2.17.1

List Of Tools To Check For Vulnerable Log4j Hosts On Your Network

  1. log4j-scan

  2. log4j_checker_beta

  3. log4j-sniffer

  4. check-log4j

Check For Vulnerable Log4j Hosts Using log4j-Scan:

Log4j-scan is a fully automated, accurate, and extensive scanner tool to check vulnerable log4j hosts on the network. You can use this tool for personal or commercial purposes to scan infrastructure for Log4J vulnerabilities, and test for WAF bypasses that can result in code execution on the organization’s environment. This tool doesn’t require setting up a DNS callback server since it supports DNS OOB callbacks.

  • It support for lists of URLs.

  • Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools).

  • Fuzzing for HTTP POST Data parameters.

  • Fuzzing for JSON data parameters.

  • Supports DNS callback for vulnerability discovery and validation.

  • WAF Bypass payloads.

How To Run Log4j-Scan Tool?

  1. Clone the git: $ git clone

  2. get inside the log4j-scan directory: $ cd log4j-scan

  3. Install the required pip packages: $ pip3 install -r requirements.txt

  4. Run the tool:

  5. To Run the help: $ python3 -h

  6. To check a single URL: $ python3 -u

  7. To checka Single URL using all Request Methods: $ python3 -u –run-all-tests

  8. To discover WAF bypasses against the environment: $ python3 -u –waf-bypass

  9. To scan a list of URLs inside a file: $ python3 -l urls.txt

Check For Vulnerable Log4j Hosts Using log4j_Checker_Beta:

This is a script to check if your server is possibly affected by log4j vulnerabilities. However, it has some accuracy concerns about the detection of vulnerabilities in the Log4j library. Since it uses library version is one of the main criteria. Despite that, a good thing about his tool is that it supports archive files like WAR and EAR. This tool is capable of checking:

  • It scans files for occurrences of log4j

  • It checks for packages containing log4j and Solr ElasticSearch

  • It checks if Java is installed

  • Analyzes JAR/WAR/EAR files

  • Option of checking hashes of .class files in archives

How To Run log4j_Checker_Beta?

Run this command to download the script and run on your machine

# wget -q -O - |bash

Run this command to see only warning in the output:

# wget -q -O - | bash | grep '\[WARNING\]'

Note: Ensure ‘locate’ and ‘unzip’ commends need to be installed and locate database is updated before you run the commands. results would be more accurate if you run these commands with superuser privilege.

# sudo apt install unzip locate# sudo updatedb

If you want to run this script on the machine which doesn’t have the internet connection, clone the git repository.

# cd log4j_checker_beta/
# ./ hashes-pre-cve_local.txt | grep '\[WARNING\]'

Check For Vulnerable Log4j Hosts Using log4j-Sniffer:

log4j-sniffer crawls for all instances of log4j on disk within a specified directory. It is one of the accurate tools to identify the vulnerable instances of Log4j within a directory tree. It is not limited to working only with Java archives, it supports a wide range of archives such as .zip, tar, .tar.gz, .tgz, .tar.bz2, .tbz2.

log4j-sniffer will scan for all files of the following types based upon suffix:

  1. Zips: .zip

  2. Java archives: .jar, .war, .ear

  3. Tar: .tar, .tar.gz, .tgz, .tar.bz2, .tbz2

How to run log4j-sniffer?

  1. Install using ‘go’: $ go install


  1. Download compelled executables for Linux, Windows, and mac from:

  2. On Ubuntu: $ wget

  3. Extract The Downloaded File:

$ tar -xf log4j-sniffer-1.0.0-linux-amd64.tgz

3. Run log4j-sniffer:

  1. For Help Run: $ ./log4j-sniffer -h

4. Run the log4j-sniffer with crawl flag which takes directory path as imput to crawl for vulnerable Log4j libraries.

  1. $ ./log4j-sniffer crawl /opt/splunk/

Check For Vulnerable Log4j Hosts Using Check-Log4j:

Check-log4j is a tool developed by yahoo to check whether the host is vulnerable to the Log4j. This tool works entirely in a different way than other tools. It attempts to verify the service by triggering the exploit. But, on the other hand, it doesn’t tell that you may not know whether you have a vulnerable version of log4j on your system. Please see the manual page for full details.

How to Run Check-Log4j?

  1. Clone the git: $ git clone

  2. Change the directory to: $ cd check-log4j/src

  3. Run check-log4j: $ ./ -p /opt/splunk

  4. For help: $ ./ -h

We hope this post would help you know 4 Powerful Tools to Check for Vulnerable Log4j Hosts. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on FacebookLinkedInTwitterTelegramTumblr, & Medium and subscribe to receive updates like this.

Arun KL

Arun KL is a cybersecurity professional with 15+ years of experience in IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.

Recently added

Application Security

View All

Learn More About Cyber Security Security & Technology

“Knowledge Arsenal: Empowering Your Security Journey through Continuous Learning”

Cybersecurity All-in-One For Dummies - 1st Edition

"Cybersecurity All-in-One For Dummies" offers a comprehensive guide to securing personal and business digital assets from cyber threats, with actionable insights from industry experts.



View All

Learn Something New with Free Email subscription