skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

expression-language-injection

Detects and exploits Expression Language injection in SpEL, OGNL, and Java EL frameworks.

Updated Jun 5, 2026
Search Tags:#penetration testing#spring#rce#spel#ognl#struts2#el injection
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill expression-language-injection-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: expression-language-injection
Source: https://github.com/lNwNl/Praxis/tree/main/skills/expression-language-injection
Command: npx skills add https://github.com/lNwNl/Praxis --skill expression-language-injection-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Java applications using Spring, Struts2, or Confluence may evaluate attacker-controlled input as Expression Language, leading to remote code execution. This Skill provides a structured playbook to detect, confirm, and exploit EL injection vulnerabilities during authorized penetration tests and CTF challenges. ## Core Features & Use Cases - Polyglot Detection Probes: Distinguish SpEL, OGNL, and Java EL engines using ${7*7}, #{7*7}, and %{7*7} probes with a disambiguation table. - Engine-Specific Exploitation: Ready-to-use RCE payloads for SpEL (Runtime.exec, ProcessBuilder, output capture), OGNL (Struts2 _memberAccess sandbox bypass, blacklist clearing), and Java EL (reflection-based execution). - Real-World CVE Chains: Step-by-step exploitation for Spring Cloud Gateway CVE-2022-22947, Confluence CVE-2021-26084, and key Struts2 CVEs (S2-045, S2-046, S2-057). - Use Case: During a web CTF, you find ${7*7} reflected as 49 in a Spring app. Use this Skill to confirm SpEL, check for the actuator gateway endpoint, and execute commands with output captured in a response header. ## Quick Start Use the expression-language-injection skill to test this Java target for SpEL and OGNL injection and escalate any confirmed evaluation to command execution.

Frequently Asked Questions about expression-language-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Expression Language injection in a Java application?▼

Send polyglot probes like ${7*7}, #{7*7}, and %{7*7} and check if the response contains 49. The syntax that evaluates identifies the engine: ${} indicates SpEL or Java EL, while %{} indicates OGNL in Struts2.

What is the difference between SSTI and EL injection?▼

SSTI targets template rendering engines like Jinja2, FreeMarker, or Twig, while EL injection targets expression evaluators embedded in Java frameworks such as Spring SpEL and Struts2 OGNL. They share detection probes like ${7*7} but diverge in exploitation payloads.

How do I bypass the Struts2 OGNL sandbox?▼

Reset the security restrictions by setting _memberAccess to @ognl.OgnlContext@DEFAULT_MEMBER_ACCESS in your payload. For later Struts2 versions, clear the OgnlUtil excludedClasses and excludedPackageNames blacklists before calling Runtime.exec.

How do I exploit Spring Cloud Gateway CVE-2022-22947?▼

POST a malicious route to /actuator/gateway/routes containing a SpEL expression in an AddResponseHeader filter, then POST to /actuator/gateway/refresh and trigger the route. Command output appears in the response header, and you should delete the route afterward.

What error messages reveal which EL engine is in use?▼

Exception class names in error responses identify the engine: ognl.OgnlException indicates OGNL, SpelEvaluationException indicates Spring SpEL, and javax.el.ELException indicates standard Java EL in JSP or JSF.

What can I do when SpEL T() operator is blocked?▼

When SimpleEvaluationContext restricts the T() type operator, use a reflection-based bypass such as ''.class.forName('java.lang.Runtime') to reach Runtime.exec. Alternatively try ProcessBuilder or ScriptEngine as execution methods.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

hunt-springboot

Detect Spring Boot-specific vulnerabilities including Actuator endpoints, SpEL injection, and Spring4Shell.

Community
Intermediate
AeonDaveAeonDave
15

ligolo-ng

Establish a reverse tunnel via TUN interface for pivoting into internal networks.

Community
Advanced
ok-helloworldok-helloworld
241

expression-language-injection

Detect and validate expression language injection in Java EL evaluators.

Community
Advanced
securityfortechsecurityfortech
6

ssti

Detect and exploit Server-Side Template Injection vulnerabilities in web applications.

Official
Advanced