expression-language-injection

Detect Java expression language injection by injecting polyglot probes like ${7*7}, %{7*7}, and #{7*7} into web application inputs to identify if SpEL, OGNL, or Java EL evaluates attacker-controlled data. Response behaviors and exception messages confirm the active expression engine.

SpEL injection and OGNL injection testing differ by target framework and syntax. SpEL targets Spring framework evaluators while OGNL targets Struts2 and Confluence-style paths. Detection uses framework-scoped probes to distinguish engines based on syntax parsing and specific response behaviors.

Bypass sandbox restrictions during SpEL injection testing by analyzing runtime restriction mechanics and attempting member-access manipulation or blacklist clearing. The skill provides targeted exploitation guidance for common sandbox controls to validate true risk.

Yes, expression language injection testing supports Spring SpEL and Struts2 OGNL consumers, alongside JSP/JSF bindings and Confluence-style OGNL paths. It uses framework-scoped detection probes to validate vulnerabilities across these specific Java web frameworks.

Distinguish Java EL injection from server-side template injection by interpreting response syntax and exception messages. The skill routes triage to appropriate playbooks based on observed behaviors, disambiguating SSTI and related injection classes like JNDI from true expression language evaluation.

Polyglot payloads for OGNL injection detection may fail when application sandboxing blocks basic arithmetic evaluation or suppresses error messages. When standard probes return ambiguous results, engine-specific exploitation attempts and exception message analysis are required to validate the vulnerability.