Expression Language Injection

This is a deep playbook for exploiting expression language injection in Java frameworks, covering SpEL in Spring, OGNL in Struts2, and Java EL in JSP/JSF. It walks through sandbox bypasses like `_memberAccess` manipulation, includes CVE-specific exploits like Spring Cloud Gateway's CVE-2022-22947 via actuator abuse, and provides polyglot probes to distinguish between different EL engines. The distinction from SSTI is clear: you're targeting expression evaluators, not template engines, though detection often starts with the same `${7*7}` probe. If you're pentesting Java apps or dealing with legacy Struts2 deployments, this gives you ready-to-use payloads and the methodology to adapt them when sandboxes block the obvious paths.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill expression-language-injection --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Expression Language Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, _memberAccess manipulation, actuator abuse, and real-world CVE chains.

0. RELATED ROUTING

ssti-server-side-template-injection for template engines (Jinja2, FreeMarker, Twig) — different attack surface
jndi-injection when EL evaluation leads to JNDI lookup

Key distinction: SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes (${7*7}) but diverge in exploitation.

1. DETECTION — POLYGLOT PROBES

${7*7}              → 49 = SpEL, OGNL, or Java EL
#{7*7}              → 49 = SpEL (alternative syntax) or JSF EL
%{7*7}              → 49 = OGNL (Struts2)
${T(java.lang.Math).random()}  → random float = SpEL confirmed
%{#context}         → object dump = OGNL confirmed

SKILL.md on GitHub