Skip to content
HackIndex logo

HackIndex

Nmap RMI Registry Dump (rmi-dumpregistry)

2 min read Apr 4, 2026

The RMI registry on port 1099 (or other configured ports) acts as a naming service for remote Java objects. Dumping the registry reveals bound names — the identifiers used to look up remote objects — along with class names, interfaces, and sometimes classpath entries that expose the application stack. The most important finding is jmxrmi or similar JMX-related bindings, which pivot directly into JMX enumeration.

Service Detection

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 1099,8686,9010,9999,1100,4444 $TARGET_IP 
1099/tcp open  rmiregistry Java RMI
8686/tcp open  rmiregistry Java RMI
Explain command
-sV Probe open ports to determine service version info.
-p 1099,8686,9010,9999,1100,4444 Scan only the specified comma-separated ports.
$TARGET_IP Placeholder for the target host IP address.

Port 1099 is the default RMI registry port. Port 8686 is common in GlassFish and application server JMX configurations. When multiple ports show as rmiregistry, dump each — they may expose different bindings.

Dump Registry Bindings

┌──(kali㉿kali)-[~]
└─$ nmap -p 1099 $TARGET_IP --script rmi-dumpregistry 
| rmi-dumpregistry:
|   jmxrmi
|     javax.management.remote.rmi.RMIServer
|     @10.10.10.50:45231
|     extends
|       java.lang.reflect.Proxy
|   cfassembler/default
|     coldfusion.flex.rmi.DataServicesCFProxyServer_Stub
|     @10.10.10.50:1271
|     Custom data
|       Classpath
|_        file:/C:/CFusionMX7/runtime/../lib/axis.jar
Explain command
-p 1099 Scan only port 1099, the default Java RMI registry port.
$TARGET_IP Placeholder for the target host IP address.
--script rmi-dumpregistry Run NSE script to enumerate and dump Java RMI registry entries.

jmxrmi in the binding list is the highest-priority finding — it confirms JMX is exposed via RMI and gives you the endpoint port (45231 in this example). Move directly to JMX enumeration with jmxterm. The classpath entries in the dump reveal internal file paths, JAR names, and the application server type.

┌──(kali㉿kali)-[~]
└─$ nmap -p 8686 $TARGET_IP --script rmi-dumpregistry
Explain command
-p 8686 Scan only port 8686 (default Java RMI registry port).
$TARGET_IP Placeholder for the target host IP address.
--script rmi-dumpregistry Run NSE script to enumerate and dump Java RMI registry entries.

When Dumping Fails but Port is Open

Some registry configurations block listing but still respond to direct lookups. Note the port and move to rmg for a more capable client:

┌──(kali㉿kali)-[~]
└─$ nc -zv $TARGET_IP 1099 && echo 'port reachable' 
Connection to 10.10.10.50 1099 port [tcp/rmiregistry] succeeded!
port reachable
Explain command
-z Zero-I/O mode; scan without sending data, used for port checking.
-v Verbose mode; prints connection status and error details.
$TARGET_IP Placeholder for the target host IP address.
1099 Target port number; default RMI registry port.

Port reachable but no dump output means the registry is filtering or requires a specific client interaction. Move to rmg for registry enumeration.

References