# veracode-research/rogue-jndi

A malicious LDAP server for JNDI injection attacks

Repository: https://github.com/veracode-research/rogue-jndi
Canonical: https://ross.abutalabs.com/products/rogue-jndi
Language: Java
License: MIT
License Family: permissive
Last push: 2023-09-28T17:20:20+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2485, "days_push": 1070, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1086, forks 226 (observed 2026-08-28T04:03:32.148405+00:00)

## What it is
Rogue JNDI is a malicious LDAP and HTTP server written in Java for exploiting insecure JNDI API usage in Java applications. It serves various payloads (remote classloading, unsafe reflection, XXE) to achieve remote code execution during penetration tests.

## Use cases
- test java applications for jndi injection vulnerabilities
- demonstrate log4shell-style ldap exploitation in a pentest
- simulate malicious ldap server for rce payloads
- verify jndi lookup security fixes on tomcat or websphere
- exploit insecure jndi remote classloading during authorized security assessment

## When to choose
- you are doing an authorized penetration test of a Java application with JNDI endpoints
- you need ready-made payloads for Tomcat, Groovy, or WebSphere JNDI attack vectors
- you want a lightweight single-jar tool to demonstrate JNDI injection risks

## When to avoid
- you need a general-purpose LDAP directory server
- you lack authorization to test the target system
- your target runs modern JDKs where remote classloading is disabled and no alternate payload applies

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, http-server, cli
- domain: security, penetration-testing, developer-tools
- platform: jvm, cross-platform, cli
- tags: jndi-injection, ldap-server, exploitation, rce, log4shell, penetration-testing, java-security

## Member repositories
- veracode-research/rogue-jndi (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:32.148405+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:49:37.501339+00:00, confidence not recorded.
  - readme: https://github.com/veracode-research/rogue-jndi (fetched 2026-08-28T04:03:32.148405+00:00, sha a2e6f1a7f362)
- Data as of 2026-08-30T08:39:29.467469+00:00.