English | 简体中文
Java-Chains is a Java payload generation platform for security researchers. Its web interface supports common Java payload generation and JNDI, FakeMySQL, and JRMP testing.
Standing on the shoulders of giants
Docs: https://java-chains.github.io/en/docs/guide
Plugin development reference: https://github.com/Java-Chains/chains-plugin-demo
# Extract the release package and place its chains-config directory next to docker-compose.yml # If chains-config is empty, the container will start but cannot access the image's bundled configuration and plugins docker compose up -d # After startup, find the login credentials on the "Auth" line in the logs docker logs -f java-chains | grep -i auth
Open http://your-ip:8011
| Port | Purpose |
|---|---|
8011 |
Web interface |
58080 |
JNDI HTTP service |
50389 |
JNDI LDAP service |
50388 |
JNDI RMI service |
3308 |
FakeMySQL service |
13999 |
JRMP Listener service |
50000 |
HTTP service |
11527 |
TCP service |
docker run -d \
--name java-chains \
--restart=unless-stopped \
-p 8011:8011 \
-p 58080:58080 \
-p 50389:50389 \
-p 50388:50388 \
-p 3308:3308 \
-p 13999:13999 \
-p 50000:50000 \
-p 11527:11527 \
-e CHAINS_AUTH=true \
-e CHAINS_PASS= \
javachains/javachains:latest # or pin a version, e.g. javachains/javachains:2.0.1Empty CHAINS_PASS → a random password is generated at startup (see the Auth line in logs).
CHAINS_AUTH=false also requires CHAINS_ALLOW_AUTH_DISABLED=true (explicit acknowledgement).
Requires OpenJDK / Temurin / Zulu JDK 8 (Oracle JDK 8 is not recommended for BCEL chains).
tar -xzf java-chains-2.0.1.tar.gz cd java-chains-2.0.1 # or unpack layout with java-chains.jar + chains-config/ java -jar java-chains.jar
For personal research and learning only. Never use for illegal activity.
The developers, providers and maintainers are not responsible for actions or consequences of using this tool; users assume all risk.
Acknowledgments:
- https://github.com/ReaJason/MemShellParty
- https://github.com/wh1t3p1g/ysomap
- https://github.com/qi4L/JYso
- https://github.com/X1r0z/JNDIMap
- https://github.com/Whoopsunix/PPPYSO
- https://github.com/jar-analyzer/class-obf
- https://github.com/4ra1n/mysql-fake-server
- https://github.com/mbechler/marshalsec
- https://github.com/frohoff/ysoserial
- https://github.com/H4cking2theGate/ysogate
- https://github.com/Bl0omZ/JNDIEXP
- https://github.com/kezibei/Urldns
- https://github.com/rebeyond/JNDInjector
- https://github.dev/LxxxSec/CTF-Java-Gadget
- https://github.com/pen4uin/java-memshell-generator
- https://github.com/pen4uin/java-echo-generator
- https://github.com/NickstaDB/SerializationDumper
- https://xz.aliyun.com/t/5381
- http://rui0.cn/archives/1408
If you have any questions, please open an issue or join Discord.