skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

expression-language-injection

Detect and exploit expression language injection in Java frameworks.

5|2|Updated May 16, 2026
Search Tags:#rce#spel#expression language#ognl#java el#sandbox bypass#cve exploitation
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill expression-language-injection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: expression-language-injection
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/expression-language-injection
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill expression-language-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Expression Language injection helps you identify and compromise cases where Java expression evaluators (EL/SpEL/OGNL/MVEL) process attacker-controlled input, often leading to sandbox bypass and RCE.

Core Features & Use Cases

  • Framework-specific detection: Use polyglot probes to distinguish Java EL, SpEL, and OGNL execution paths during live testing.
  • Sandbox bypass and execution: Apply targeted techniques for SpEL and Struts2 OGNL, including member access manipulation and blacklist clearing to reach runtime command execution.
  • Real-world CVE-style routing: Leverage example chains such as Spring Cloud Gateway actuator route manipulation and Confluence OGNL injection patterns.

Quick Start

Ask the assistant to provide a step-by-step detection and exploitation plan for a suspected Spring/Struts2/Confluence expression-language injection, including sandbox bypass approaches and safe cleanup steps after attempting execution.

Frequently Asked Questions about expression-language-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect and exploit Java expression language injection during a penetration test?▼

SpEL and OGNL sandbox bypasses are achieved through targeted techniques like member access manipulation and blacklist clearing, enabling runtime command execution in Spring and Struts2 environments.

How do I bypass SpEL and OGNL sandboxes to achieve remote code execution?▼

SpEL and OGNL sandbox bypasses are achieved through targeted techniques like member access manipulation and blacklist clearing, enabling runtime command execution in Spring and Struts2 environments.

What is the difference between template injection and expression language evaluation in Java frameworks?▼

Expression language evaluation processes attacker-controlled input through engines like SpEL, OGNL, and Java EL, whereas template injection focuses on template rendering engines, requiring engine-specific probes to disambiguate during live testing.

Can I use this approach to exploit CVE-style vulnerabilities in Spring Cloud Gateway and Confluence?▼

Yes, real-world CVE-style exploitation routes include Spring Cloud Gateway actuator route manipulation and Confluence OGNL injection patterns, targeting framework-specific request vectors for authorized security research.

What frameworks and evaluation engines are targeted by expression language injection techniques?▼

Targeted frameworks include Spring, Struts2, and Confluence, focusing on SpEL, OGNL, Java EL, and MVEL evaluation engines that process attacker-controlled input leading to sandbox bypass and RCE.

Related Skills

Explore More Education & Research Skills→
YlikenYliken
5

xslt-injection

Identify and exploit XSLT processing weaknesses across engines.

Community
Advanced
jibaxZZZjibaxZZZ

action

Validate cleanup targets and execute conditional actions in batches of five.

Community
Intermediate
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

ssti-freemarker

Identify Java template engines and generate SSTI payloads for RCE and file reading.

Official
Advanced