jndi-injection

A security-testing playbook for JNDI injection, the vulnerability class in which a Java application performs a naming lookup on attacker-controlled input and is coerced into loading or executing remote code. It is meant for situations where code reaches InitialContext.lookup with untrusted data, especially through Log4j2, Spring, or similar sinks, and it clarifies how JNDI injection differs from generic deserialization.

It walks through the core mechanism and the main attack vectors: RMI and LDAP for class loading, and DNS for detection-only confirmation. A JDK version table explains how mitigations added in 8u121 and 8u191 constrain remote class loading and which bypasses remain, including returning a serialized gadget object over LDAP when a gadget chain is on the classpath, and abusing Tomcat BeanFactory with expression-language evaluation. Tooling coverage includes marshalsec reference servers, JNDI-Injection-Exploit, and RogueJndi.

A dedicated section covers Log4Shell (CVE-2021-44228): how Log4j2 lookups evaluate a jndi expression inside any logged string, detection payloads, injection points such as headers and form fields, WAF-bypass obfuscation variants, a split-log bypass, and affected versions from 2.0-beta9 through 2.14.1 with full fixes in 2.17.0 and Log4j 1.x unaffected. It also lists other JNDI sinks across Spring, Solr, Druid, vCenter, H2, and Fastjson, and provides a testing methodology that starts with a safe DNS probe to confirm evaluation before escalating based on the JDK version. Use it to identify, confirm, and safely demonstrate JNDI injection during application security testing.