expression-language-injectionlisted

# SKILL: Expression Language Injection — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, `_memberAccess` manipulation, actuator abuse, and real-world CVE chains. ## 0. RELATED ROUTING - [ssti-server-side-template-injection](../ssti-server-side-template-injection/SKILL.md) for template engines (Jinja2, FreeMarker, Twig) — different attack surface - [jndi-injection](../jndi-injection/SKILL.md) when EL evaluation leads to JNDI lookup **Key distinction**: SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes (`${7*7}`) but diverge in exploitation. --- ## 1. DETECTION — POLYGLOT PROBES ```text ${7*7} → 49 = SpEL, OGNL, or Java EL #{7*7} → 49 = SpEL (alternative syntax) or JSF EL %{7*7} → 49 = OGNL (Struts2) ${T(java.lang.Math).random()} → random float = SpEL confirmed %{#context} → object dump = OGNL confirmed ``` ### Disambiguation | Response to `${7*7}` | Response to `%{7*7}` | Engine | |---|---|---| | 49 | literal `%{7*7}` | SpEL or Java EL | | literal `${7*7}` | 49 | OGNL (Struts2) | | 49 | 49 | Both may be active | --- ## 2. SpEL (SPRING EXPRESSION LANGUAGE) ### Where SpEL Appears - `@Value("${...}")` annotati