# Java RMI / JMX

> Java remote management

- **URL:** https://hackindex.io/services/java-rmi-jmx
- **Type:** Service
- **Default ports:** 1099, 8686
- **Tags:** java, rmi, jmx, remote, network
- **Published:** 2026-01-26
- **Updated:** 2026-07-14

Java RMI (Remote Method Invocation) allows Java objects to be invoked remotely across a network. The RMI registry listens on **TCP port 1099** by default. JMX (Java Management Extensions) typically rides on top of RMI for remote monitoring and management. Nmap identifies the RMI registry as `java-rmi`.

RMI and JMX endpoints are high-value targets because they often allow unauthenticated remote code execution. The RMI registry exposes bound objects that can be queried and invoked. JMX with remote access enabled frequently lacks authentication, granting full control over the JVM, including the ability to load arbitrary MBeans and execute operating system commands. Java deserialization vulnerabilities (such as those exploited by ysoserial) make exposed RMI endpoints especially dangerous.

Enumeration starts with querying the RMI registry to list bound objects using tools like `rmg` (remote-method-guesser) or Nmap's `rmi-dumpregistry` script. JMX endpoints can be probed with `jconsole` or `jmxterm` for unauthenticated access. Testing for deserialization attacks with `ysoserial` payloads and checking for known vulnerable application servers (JBoss, WebLogic, Tomcat) are standard exploitation paths.

## Phases

- [Enumeration](https://hackindex.io/services/java-rmi-jmx/enumeration.md): Guides for dumping RMI bindings, JMX MBeans, and endpoints (3 guides)
- [Exploitation](https://hackindex.io/services/java-rmi-jmx/exploitation.md): RCE via unauthenticated JMX using MLet and MBean loading (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/java-rmi-jmx/vulnerability-discovery.md): Find unauth JMX access and extract creds via jmxterm (1 guides)