jndi-injection

Name: jndi-injection
Availability: InStock
Author: ok-helloworld

Detect Java JNDI injection sinks and map feasible RMI, LDAP, or DNS vectors.

241|28|Updated May 20, 2026

Search Tags:#security testing #java #waf bypass #log4shell #jndi injection #dns confirmation #ldap exploitation

Ready to run

npx skills add https://github.com/ok-helloworld/vibe-pentest --skill jndi-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: jndi-injection
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/jndi-injection
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill jndi-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

JNDI injection in Java allows attacker-controlled lookups to trigger outbound connections and potentially remote class loading or code execution, so testers need a reliable way to confirm the sink and assess exploitability.

Core Features & Use Cases

Attack Surface Guidance: Targets cases where untrusted input reaches InitialContext.lookup() and other JNDI sinks.
Environment-Aware Exploitability: Covers JDK version constraints and the post-8u191 shift to LDAP-based serialized-gadget and BeanFactory/EL abuse paths.
Log4Shell Mapping (CVE-2021-44228): Provides Jndi lookup payloads, detection-only DNS confirmation, and WAF bypass variants to validate whether logging triggers the JNDI evaluation.

Quick Start

Ask the assistant to generate a JNDI injection testing plan for your Java target, including a DNS-only confirmation step and the appropriate LDAP/RMI strategy based on the detected JDK behavior.

Frequently Asked Questions about jndi-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for JNDI injection in Java web applications?▼

Testing for JNDI injection involves detecting if untrusted input reaches InitialContext.lookup to trigger outbound connections. You must select safe confirmation payloads and map feasible RMI, LDAP, or DNS vectors to verify exploitability in the Java target.

How does Log4Shell JNDI lookup exploitation work for CVE-2021-44228?▼

Log4Shell exploitation works by injecting JNDI lookup payloads into logged paths, triggering the JNDI evaluation. Testers use detection-only DNS confirmation and WAF bypass variants to validate whether logging successfully triggers the outbound JNDI connection.

Can I bypass JDK constraints for LDAP exploitation after update 8u191?▼

You can bypass post-8u191 JDK constraints by shifting to LDAP-based serialized-gadget or BeanFactory and EL abuse paths. This approach infers version-appropriate bypass strategies to achieve remote code execution where direct remote class loading is restricted.

What is the best way to confirm a JNDI injection vulnerability without causing harm?▼

The best way to confirm a JNDI injection vulnerability safely is by using dedicated DNS confirmation steps. This detection-only approach verifies the sink evaluation by mapping outbound DNS connections without executing malicious payloads or remote class loading.

Do I need marshalsec and ysoserial for Java JNDI security testing?▼

You need marshalsec and ysoserial to provide dedicated tooling guidance for Java JNDI security testing. These tools help generate the required LDAP serialized gadgets and payloads to infer version-appropriate bypass paths and confirm remote code execution.