Agent skill · security · yaklang
jndi-injection
JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().
Why this skill is useful
Adds detailed attack vectors, JDK version constraints, and executable scripts for JNDI exploitation that are not commonly known.
What it needs
Requires java installed locally. About 4k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: JNDI Injection — Expert Attack Playbook AI LOAD INSTRUCTION: Expert JNDI injection techniques. Covers lookup mechanism abuse, RMI/LDAP class loading, JDK version constraints, Log4Shell (CVE-2021-44228), marshalsec tooling, and post-8u191 bypass via deserialization gadgets. Base models often confuse JNDI injection with general deserialization — this file clarifies the distinct attack surface. 0. RELATED ROUTING deserialization-insecure when JNDI leads to deserialization (post-8u191 bypass path) expression-language-injection when the JNDI sink is reached via SpEL or OGNL expression evaluation --- 1. CORE MECHANISM JNDI (Java Naming and Directory Interface) provides a unified API for looking up objects from naming/directory services (RMI, LDAP, DNS, CORBA). Vulnerability: when InitialContext.lookup(USERINPUT) receives an attacker-controlled URL, the JVM connects to the attacker's server and loads/executes arbitrary code. --- 2. ATTACK VECTORS RMI (Remote Method Invocation) Attacker runs an RMI server returning a Reference object pointing to a remote class: LDAP Attacker runs an LDAP server returning entries with javaCodeBase, javaFactory, or serialized object attributes. LDAP is preferred over RMI because LDAP restrictions were added later (JDK 8u191 vs 8u121 for RMI). DNS (detection only) Useful for confirming JNDI injection without RCE — triggers DNS query to attacker's authoritative NS. --- 3. JDK VERSION CONSTRAINTS AND BYPASS JDK Version RMI Remote Class LDAP Remote Class Bypass --- --- --- --- < 8u121 YES YES Direct class loading 8u121 – 8u190 NO (trustURLCodebase=false) YES Use LDAP vector >= 8u191 NO NO Return serialized gadget object via LDAP >= 8u191 (alternative) NO NO BeanFactory + EL injection Post-8u191 Bypass: LDAP → Serialized Gadget Instead of returning a remote class URL, the attacker's LDAP server returns a serialized Java object in the javaSerializedData attribute. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/jndi-injection