Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

small improvements #11

Closed
wants to merge 1 commit into from
Closed

small improvements #11

wants to merge 1 commit into from

Conversation

fopina
Copy link
Contributor

@fopina fopina commented Dec 16, 2021

I've opened this to portswigger's fork of yours - PortSwigger#2

In case you want to merge them sooner :) (and care to comment as you're actually the developer and I only noticed after opening the PR)

@dnet
Copy link
Contributor

dnet commented Dec 16, 2021

I like the invalid port, but what's the purpose/advantage of the test without lookups?

@fopina
Copy link
Contributor Author

fopina commented Dec 16, 2021

Include test without any lookups: in some setups, some lookups fail. to avoid missing true positives, add one iteration without any

quote from the other PR.
in some scenarios the hostName (and many other lookups) fail.

so far, I’ve seen the env:USER as the one that always works, but I rather do a blank test without any to flag it vulnerable at least.

Hostname extraction can easily be done after, if it works.

not sure about reasons for failed hostnams (yet), but I assume either weird hostnames that are not allowed//complaint dns requests or some different log4j version..

@fopina fopina closed this Jan 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants