# Nmap RMI Registry Dump (rmi-dumpregistry)

- **URL:** https://hackindex.io/services/java-rmi-jmx/enumeration/nmap-rmi-registry-dump
- **Path:** Java RMI / JMX > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/java-rmi-jmx/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-04-04

The RMI registry on port 1099 (or other configured ports) acts as a naming service for remote Java objects. Dumping the registry reveals bound names (the identifiers used to look up remote objects) along with class names, interfaces, and sometimes classpath entries that expose the application stack. The most important finding is `jmxrmi` or similar JMX-related bindings, which pivot directly into [JMX enumeration](https://hackindex.io/services/java-rmi-jmx/enumeration/jmx-enumeration-with-jmxterm-jmx-over-rmi).

- Service Detection
- Dump Registry Bindings
- When Dumping Fails but Port is Open

## Service Detection

```bash
nmap -sV -p 1099,8686,9010,9999,1100,4444 $TARGET_IP
# 1099/tcp open  rmiregistry Java RMI
# 8686/tcp open  rmiregistry Java RMI
```

Port 1099 is the default RMI registry port. Port 8686 is common in GlassFish and application server JMX configurations. When multiple ports show as rmiregistry, dump each: they may expose different bindings.

## Dump Registry Bindings

```bash
nmap -p 1099 $TARGET_IP --script rmi-dumpregistry
# | rmi-dumpregistry:
# |   jmxrmi
# |     javax.management.remote.rmi.RMIServer
# |     @10.10.10.50:45231
# |     extends
# |       java.lang.reflect.Proxy
# |   cfassembler/default
# |     coldfusion.flex.rmi.DataServicesCFProxyServer_Stub
# |     @10.10.10.50:1271
# |     Custom data
# |       Classpath
# |_        file:/C:/CFusionMX7/runtime/../lib/axis.jar
```

`jmxrmi` in the binding list is the highest-priority finding: it confirms JMX is exposed via RMI and gives you the endpoint port (45231 in this example). Move directly to [JMX enumeration with jmxterm](https://hackindex.io/services/java-rmi-jmx/enumeration/jmx-enumeration-with-jmxterm-jmx-over-rmi). The classpath entries in the dump reveal internal file paths, JAR names, and the application server type.

```bash
nmap -p 8686 $TARGET_IP --script rmi-dumpregistry
```

## When Dumping Fails but Port is Open

Some registry configurations block listing but still respond to direct lookups. Note the port and move to rmg for a more capable client:

```bash
nc -zv $TARGET_IP 1099 && echo 'port reachable'
# Connection to 10.10.10.50 1099 port [tcp/rmiregistry] succeeded!
# port reachable
```

Port reachable but no dump output means the registry is filtering or requires a specific client interaction. Move to [rmg for registry enumeration](https://hackindex.io/services/java-rmi-jmx/enumeration/java-rmi-with-rmg-remote-method-guesser).

## References

- [nmap: rmi-dumpregistry NSE](https://nmap.org/nsedoc/scripts/rmi-dumpregistry.html) - Dumps RMI registry bindings and object class information