Java RMI / JMX

Java RMI (Remote Method Invocation) allows Java objects to be invoked remotely across a network. The RMI registry listens on TCP port 1099 by default. JMX (Java Management Extensions) typically rides on top of RMI for remote monitoring and management. Nmap identifies the RMI registry as java-rmi.

RMI and JMX endpoints are high-value targets because they often allow unauthenticated remote code execution. The RMI registry exposes bound objects that can be queried and invoked. JMX with remote access enabled frequently lacks authentication, granting full control over the JVM, including the ability to load arbitrary MBeans and execute operating system commands. Java deserialization vulnerabilities (such as those exploited by ysoserial) make exposed RMI endpoints especially dangerous.

Enumeration starts with querying the RMI registry to list bound objects using tools like rmg (remote-method-guesser) or Nmap's rmi-dumpregistry script. JMX endpoints can be probed with jconsole or jmxterm for unauthenticated access. Testing for deserialization attacks with ysoserial payloads and checking for known vulnerable application servers (JBoss, WebLogic, Tomcat) are standard exploitation paths.