JMX Unauthenticated Access

JMX without authentication exposes the full management plane of the Java application: runtime information, configuration, deployed applications, user stores, and management operations. The exposure scope depends on which MBeans are registered. At minimum you get JVM internals. In application server deployments you often get deployed application names, datasource connection strings including credentials, and operations that trigger application behavior. This is an immediate critical finding. It enables credential theft, remote code execution through MBean write operations, and full configuration disclosure. Some servers enforce authentication only on write operations while allowing unauthenticated reads. If a password prompt appears on connection, pivot to credential attacks against the JMX service. Confirm JMX connectivity through jmxterm enumeration first.

• Confirm Unauthenticated Connection
• Extract System Properties
• Enumerate Tomcat Deployed Applications
• Read Datasource Connection Strings
• Check Threading and Memory for Impact Assessment

Confirm Unauthenticated Connection

Domains returned without a credential prompt confirms unauthenticated access. Each domain maps to a distinct attack surface. The java.lang domain exposes JVM internals: system properties, threading, memory, and the class path. Catalina indicates a running Tomcat instance with deployment, context, and session management access. com.sun.management provides JVM monitoring and diagnostic operations including on-demand heap dumps. Work through each domain systematically using the beans command. Application-specific domains such as org.springframework or com.zaxxer indicate third-party frameworks with their own registered MBeans and potentially more embedded credentials. No output at all means the connection failed or the RMI registry resolved to a different service on that port.

Extract System Properties

System properties often contain application configuration including database URLs, credentials, and internal hostnames. Empty output means no sensitive keys appear at the system property level, but the application may still expose credentials through individual MBean attributes in other domains. Internal hostnames in JDBC URLs expose backend network topology useful for lateral movement planning. Multiple JDBC entries indicate separate database connections and separate credential sets. Check the java.class.path property separately to map installed frameworks and library versions. Filter output for credential-related keys:

Enumerate Tomcat Deployed Applications

When the Catalina domain is present (Tomcat), list deployed web applications and their states. Manager and HostManager applications are the most valuable targets. A deployed Tomcat manager allows WAR file upload and leads directly to remote code execution on the server. List all beans in the Catalina domain and filter for management-relevant types:

The Catalina Manager context confirms the Tomcat manager is deployed: move to Tomcat manager testing. You can read the manager context attributes to confirm the deployed path and access settings. If the manager runs at a non-standard path, the path attribute on the Context MBean reveals it directly through JMX without any HTTP interaction. Read Context attributes before attempting HTTP access to know exactly what you are targeting. Deployed application names also identify additional web targets for directory brute force and vulnerability scanning.

Read Datasource Connection Strings

Application servers register datasources as MBeans: connection strings including embedded passwords are often readable. WildFly and JBoss register datasources under jboss.as or jboss.jca domains rather than Catalina. If no datasource MBeans appear under Catalina, search all registered beans before concluding nothing is exposed. Credentials extracted here give direct database access on the backend network. Search all registered beans for datasource-related names:

Check Threading and Memory for Impact Assessment

JVM thread count and heap usage give a sense of application load and help scope impact. A thread count above 100 in a web application indicates active request handling under significant load. Heap values near the committed or max threshold signal memory pressure. High used memory close to the max value means the process is under stress. Avoid MBean write operations against a memory-pressured JVM: they can trigger additional GC cycles and affect application stability. These metrics inform the decision to attempt diagnostic operations such as triggering thread dumps or reconfiguring logging levels. After collecting credentials and mapping deployed applications, pivot to exploitation. Confirmed datasource credentials move directly to database access. System property credentials often reuse across other services on the same host or internal network.