English | 简体中文

Java Chains

Java-Chains is a Java payload generation platform for security researchers. Build deserialization / JNDI / JDBC / JRMP payloads quickly and run protocol listeners (JNDI, FakeMySQL, JRMP, HTTP, TCP) from a web Studio or CLI.

Standing on the shoulders of giants

Quick start

Docs: https://java-chains.github.io/en/docs/guide

Docker Compose

# recommended: place chains-config from the release tarball next to docker-compose.yml
# (an empty ./chains-config mount still starts, but hides image-baked config/plugins)
docker compose up -d
# startup banner prints credentials on the "Auth" line
docker logs -f java-chains | grep -i auth

Open http://your-ip:8011

FakeMySQL read files: FakeMySQLReadPayload asks the victim JDBC client to send a path (e.g. /etc/passwd on the victim). Chains does not open that path inside the container. Captured bytes are written under chains-config/cache/fake-server-files/ (browse in Studio → FakeMySQL Files). The image entrypoint ensures that cache dir is writable by the non-root appuser even when the bind mount was created as root.

Docker run

docker run -d \
  --name java-chains \
  --restart=unless-stopped \
  -p 8011:8011 \
  -p 58080:58080 -p 50389:50389 -p 50388:50388 \
  -p 3308:3308 -p 13999:13999 -p 50000:50000 -p 11527:11527 \
  -e CHAINS_AUTH=true \
  -e CHAINS_PASS= \
  javachains/javachains:2.0.0-beta6

Empty CHAINS_PASS → a random password is generated at startup (see the Auth line in logs).
CHAINS_AUTH=false also requires CHAINS_ALLOW_AUTH_DISABLED=true (explicit acknowledgement).

Jar

Requires OpenJDK / Temurin / Zulu JDK 8 (Oracle JDK 8 is not recommended for BCEL chains).

tar -xzf java-chains-2.0.0-beta6.tar.gz
cd java-chains-2.0.0-beta6   # or unpack layout with java-chains.jar + chains-config/
java -jar java-chains.jar

CLI (optional)

Product CLI is the fat java-chains-cli.jar (remote catalog/generate + offline local generate). There is no separate SDK jar.

# remote generate against a running server
export CHAINS_API_TOKEN=...
java -jar java-chains-cli.jar generate \
  --execution remote --server http://127.0.0.1:8011 --token-env CHAINS_API_TOKEN \
  --payload JavaNativePayload --chain CommonsBeanutils1 --arg cmd=id --encode base64 --json

# offline local generate (fat jar)
java -jar java-chains-cli.jar generate --execution local \
  --payload JavaNativePayload --chain CommonsBeanutils1 --arg cmd=id --encode base64 --json

Release artifacts

Artifact	Contents
java-chains-<ver>.tar.gz	Server fat jar (SPA embedded) + chains-config
java-chains-<ver>-<platform>.*	Same + bundled JDK 8
java-chains-cli-<ver>.tar.gz	Product CLI fat jar + chains-config
Docker javachains/javachains:<ver>	Server image

Changelog

CHANGELOG.md

References and acknowledgments

For personal research and learning only. Never use for illegal activity.

The developers, providers and maintainers are not responsible for actions or consequences of using this tool; users assume all risk.

Acknowledgments:

• https://github.com/ReaJason/MemShellParty
• https://github.com/wh1t3p1g/ysomap
• https://github.com/qi4L/JYso
• https://github.com/X1r0z/JNDIMap
• https://github.com/Whoopsunix/PPPYSO
• https://github.com/jar-analyzer/class-obf
• https://github.com/4ra1n/mysql-fake-server
• https://github.com/mbechler/marshalsec
• https://github.com/frohoff/ysoserial
• https://github.com/H4cking2theGate/ysogate
• https://github.com/Bl0omZ/JNDIEXP
• https://github.com/kezibei/Urldns
• https://github.com/rebeyond/JNDInjector
• https://github.dev/LxxxSec/CTF-Java-Gadget
• https://github.com/pen4uin/java-memshell-generator
• https://github.com/pen4uin/java-echo-generator
• https://github.com/NickstaDB/SerializationDumper
• https://xz.aliyun.com/t/5381
• http://rui0.cn/archives/1408

Communication

If you have any questions, please open an issue or join Discord.

Star History

Contributors

Project contributors (in no particular order):