domains / families / security / jndi-injection

jndi-injection

separate

JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().

When to use

• JNDI lookup abuse
• RMI and LDAP class loading
• JDK version constraints and bypasses
• Log4Shell (CVE-2021-44228) exploitation
• marshalsec tooling
• Post-8u191 deserialization gadget bypass
• WAF bypass variants for Log4j2
• DNS detection of JNDI injection

When not to use

• General deserialization without JNDI context
• SpEL or OGNL expression evaluation without JNDI sink

Skill page

Source