Francisco Marques tofran

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

The Freenode resignation FAQ, or: "what the fuck is going on?"

IMPORTANT NOTE:

It's come to my attention that some people have been spamming issue trackers with a link to this gist. While it's a good idea to inform people of the situation in principle, please do not do this. By all means spread the word in the communities that you are a part of, after verifying that they are not aware yet, but unsolicited spam is not helpful. It will just frustrate people.

Update 3 (May 24, 2021)

A number of things have happened since the last update.

	// ==UserScript==
	// @name Aliexpress Skip Bundle Deals
	// @namespace http://tampermonkey.net/
	// @version 2025-11-09
	// @description Redirects AliExpress bundle deals page to their corresponding item pages
	// @author Andrew
	// @match https://www.aliexpress.com/*
	// @icon https://www.google.com/s2/favicons?sz=64&domain=aliexpress.com
	// @grant none
	// ==/UserScript==

	FROM nginx:alpine AS builder

	# nginx:alpine contains NGINX_VERSION environment variable, like so:
	# ENV NGINX_VERSION 1.15.0

	# Our NCHAN version
	ENV NCHAN_VERSION 1.1.15

	# Download sources
	RUN wget "http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" -O nginx.tar.gz && \

	FROM golang:alpine as builder
	WORKDIR /app
	#the following 2 steps are optional if your image does not already have the certificate
	# package installed, golang:alpine now seems to have it. But a more base image could be missing it.
	#RUN apk update && apk upgrade && apk add --no-cache ca-certificates
	#RUN update-ca-certificates
	ADD main.go /app/main.go
	RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -installsuffix cgo -o app .

	FROM scratch

	from datetime import datetime, timedelta
	import functools


	def timed_cache(**timedelta_kwargs):

	def _wrapper(f):
	update_delta = timedelta(**timedelta_kwargs)
	next_update = datetime.utcnow() + update_delta
	# Apply @lru_cache to f with no cache size limit

	# Run with python py_for_pi_day.py [number of rounds] [upper limit on random number]
	# Python 3.5+
	import math
	import random
	import sys


	def main(rounds, limit):
	print(rounds, "Rounds")
	print(limit, "Sides")