expression-language-injection

Name: expression-language-injection
Availability: InStock
Author: ok-helloworld

Detect and validate expression language injection in Java EL evaluators.

241|28|Updated May 20, 2026

Search Tags:#vulnerability assessment #spel #expression language #injection testing #ognl #java el #sandbox bypass

Ready to run

npx skills add https://github.com/ok-helloworld/vibe-pentest --skill expression-language-injection-ok-helloworld

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: expression-language-injection
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/expression-language-injection
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill expression-language-injection-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you identify and assess expression-language injection vulnerabilities in Java web frameworks where attacker-controlled input can be evaluated as SpEL, OGNL, or Java EL expressions.

Core Features & Use Cases

Framework-Specific Detection Probes: Uses quick polyglot payloads like ${77}, %{77}, and #{7*7} to distinguish supported expression engines.
Targeted Exploitation Guidance: Provides concrete exploitation paths for SpEL and OGNL, including runtime execution and actuator-related abuse patterns.
Sandbox/Restriction Bypass Ideas: Documents common sandbox mechanics and example bypass directions such as member-access manipulation and blacklist clearing.
Disambiguation & Routing: Helps route triage to related skills (e.g., SSTI vs JNDI) based on what syntax and errors appear during testing.

Quick Start

Use this skill to confirm whether a Java endpoint evaluates attacker input as SpEL, OGNL, or Java EL, and then generate an evidence-focused exploitation assessment workflow for the suspected engine.

Frequently Asked Questions about expression-language-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect Java expression language injection vulnerabilities in web applications?▼

Detect Java expression language injection by injecting polyglot probes like ${7*7}, %{7*7}, and #{7*7} into web application inputs to identify if SpEL, OGNL, or Java EL evaluates attacker-controlled data. Response behaviors and exception messages confirm the active expression engine.

What is the difference between SpEL injection and OGNL injection testing?▼

SpEL injection and OGNL injection testing differ by target framework and syntax. SpEL targets Spring framework evaluators while OGNL targets Struts2 and Confluence-style paths. Detection uses framework-scoped probes to distinguish engines based on syntax parsing and specific response behaviors.

How do I bypass sandbox restrictions during SpEL injection testing?▼

Bypass sandbox restrictions during SpEL injection testing by analyzing runtime restriction mechanics and attempting member-access manipulation or blacklist clearing. The skill provides targeted exploitation guidance for common sandbox controls to validate true risk.

Does this expression language injection testing support Spring and Struts2 frameworks?▼

Yes, expression language injection testing supports Spring SpEL and Struts2 OGNL consumers, alongside JSP/JSF bindings and Confluence-style OGNL paths. It uses framework-scoped detection probes to validate vulnerabilities across these specific Java web frameworks.

How do I distinguish Java EL injection from server-side template injection?▼

Distinguish Java EL injection from server-side template injection by interpreting response syntax and exception messages. The skill routes triage to appropriate playbooks based on observed behaviors, disambiguating SSTI and related injection classes like JNDI from true expression language evaluation.

What are the limitations of using polyglot payloads for OGNL injection detection?▼

Polyglot payloads for OGNL injection detection may fail when application sandboxing blocks basic arithmetic evaluation or suppresses error messages. When standard probes return ambiguous results, engine-specific exploitation attempts and exception message analysis are required to validate the vulnerability.