Skip to content
BackEsc
Connect AISign inSign up free

Java RMI · passage 3 of 7

Methodology

Text · Java RMI/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

If a Java Remote Method Invocation (RMI) service is poorly configured, it becomes vulnerable to various Remote Code Execution (RCE) methods. One method involves hosting an MLet file and directing the JMX service to load MBeans from a distant server, achievable using tools like mjet or sjet. The remote-method-guesser tool is newer and combines RMI service enumeration with an overview of recognized attack strategies.

Source: Java RMI/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 7 is a mark on the map. Named now: 1 to 7, reading order first.

  1. Java RMI§ 1text · README.md
  2. Detection§ 2text · README.md
  3. Methodology§ 3text · README.md
  4. RCE using beanshooter§ 4text · README.md
  5. Requirements§ 5text · README.md
  6. Remote Command Execution§ 61 code block · README.md
  7. RCE using Metasploit§ 71 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated