Can we find Log4Shell with Java Fuzzing? 🔥 (CVE-2021-44228 - Log4j RCE)

An exploration of using the Jazzer fuzzer to target Apache Log4j2 and attempt to uncover the Log4Shell vulnerability.

📥 Download source code and materials: academy.fuzzinglabs.com/introduction-java-fuzzing?coupon=YOU… In this video, I'm trying to find the famous java Log4Shell RCE (CVE-2021-44228) using fuzzing. I'm targeting apache log4j2 version 2.14.1 and I'm using Jazzer, the Java fuzzer developed by Code Intelligence. I will show and give you everything to reproduce the same at home ;) Don't forget to patch the apache log4j vulnerability by switching to version log4j 2.15.0 or 2.16.0. #Fuzzing #log4j #Log4Shell 00:00 Introduction 03:58 Jazzer: the best Java fuzzer 05:22 Fuzzing harness 07:38 Run the fuzzer 10:30 Why we are not finding the Log4Shell? 16:33 Final words Links: - nvd.nist.gov/vuln/detail/CVE-2021-44228 - gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 - log4j patch: github.com/apache/logging-log4j2/pull/608 - github.com/CodeIntelligenceTesting/jazzer - academy.fuzzinglabs.com/introduction-java-fuzzing?coupon=YOU… ==== 💻 FuzzingLabs Training ==== - C/C++ Whitebox Fuzzing: academy.fuzzinglabs.com/c-whitebox-fuzzing?coupon=youtube - Rust Security Audit and Fuzzing: academy.fuzzinglabs.com/rust-security-audit-and-fuzzing-trai… - WebAssembly Reversing and Dynamic Analysis: academy.fuzzinglabs.com/wasm-security-reversing-dynamic-anal… - Go Security Audit and Fuzzing: academy.fuzzinglabs.com/go-security-audit-and-fuzzing?coupon… ==== 🦄 Join the community ==== academy.fuzzinglabs.com/fuzzing-labs-community ==== 📡 Socials ==== - Twitter: twitter.com/FuzzingLabs - Telegram: t.me/fuzzinglabs Keywords: Fuzzing, Fuzz Testing, Java, Jazzer, Log4Shell, log4j, log4j2, RCE, CVE-2021-44228 Link to this video: youtu.be/t7frgKkQ1J4