Log4j vs DAST Tools – Who’s The First?

Detectify has had tests in our DAST tool, Application Scanning, since early morning December 11. In addition to that we've continued to add more security modules with different testing methods/payloads to verify if the bugs are exploitable. We test for both CVE-2021-44228: Log4Shell (log4j) RCE and CVE-2021-45046: Log4Shell (log4j) Bypass RCE. What's more interesting is that we've also added different kinds of testing in our EASM tool, Surface Monitoring which finds log4j vulnerabilities in different technologies such as Tableau, VMware, various apache software. We continually expand the coverage as we crowdsource the payloads from our Crowdsource hacker community.