Channel: LiveOverflow

Category: Education

Tags: minecraftliveoverflowloggerupdateblogladpslog4shell demojava deserializationexploit walkthroughrmilive overflowhacking tutorialremote class loadingcvejavaldap${java:ldap://liveoverflow.com}in-depthserialisationenterprise javalog4jjvmlog4shellupgrademavencve-2021-44228java logginglog4j rcevulnerabilityjavaeelog4j2object serializationexploit tutorialhow to hackobjctstreamwriteupjndiwalkthroughldap serverexploitzero day

Description: Let's try to make sense of the Log4j vulnerability called Log4Shell. First we look at the Log4j features and JNDI, and then we explore the history of the recent log4shell vulnerability. This is part 1 of a two part series into log4j. Log4j Issues: 2013: issues.apache.org/jira/browse/LOG4J2-313 2014: issues.apache.org/jira/browse/LOG4J2-905 2017: issues.apache.org/jira/browse/LOG4J2-2109 Log4j 2 Security: logging.apache.org/log4j/2.x/security.html German Government Warning: bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2021/2021-549032-10F2.pdf?__blob=publicationFile&v=3 Cloudflare: blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns A JOURNEY FROM JNDI/LDAP MANIPULATION TO REMOTE CODE EXECUTION DREAM LAND: blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf whitepaper: blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf --- 00:00 - Intro 01:05 - BugBounty Public Service Announcement 02:23 - Chapter #1: Log4j 2 03:38 - Log4j Lookups 04:15 - Chapter #2: JNDI 06:01 - JNDI vs. Log4j 06:35 - Chapter #3: Log4Shell Timeline 07:33 - Developer Experiences Unexpected Lookups 09:51 - The Discovery of Log4Shell in 2021 11:08 - Chapter #4: The 2016 JNDI Security Research 11:56 - Java Serialized Object Features 13:27 - Why Was The Security Research Ignored? 14:44 - Chapter #5: Security Research vs. Software Engineering 16:49 - Final Words and Outlook to Part 2 17:23 - Outro -=[ ❤️ Support ]=- → per Video: patreon.com/join/liveoverflow → per Month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join -=[ 🐕 Social ]=- → Twitter: twitter.com/LiveOverflow → Instagram: instagram.com/LiveOverflow → Blog: liveoverflow.com → Subreddit: reddit.com/r/LiveOverflow → Facebook: facebook.com/LiveOverflow