I'm trying to find all the ways one could execute commands in java. The goal is to make a keyword list for blacklists in static code analysis tools and filters.

So far I've only found Runtime.exec() which seems incorrect since there has to be another way without using libraries.


2 Answers 2


You should also look at ProcessBuilder. But, as rook indicates, this approach ignores all the subtle vulnerabilities that come with Java. So you should definitely also look at unsafe XML parsing (which can lead to XXE) and you should avoid deserialization of untrusted objects (VEEEEEEEEEEERY dangerous). And maybe some more.

  • I had lists with most of the other techniques, but yours and rook's answers had me go over them and add a few things. Thanks!
    – ndp
    Mar 3, 2017 at 10:02

Java as a platform, and the developers attracted to this platform, are both naive. Shells are extremely common in the Java ecosystem, and especially web applications. The most common ways that I shell Java Apps are as follows(not ordered):

  • First sentence no and to the rest: that list of links don't really answer the question.
    – Serverfrog
    Mar 2, 2017 at 17:10
  • 1
    @Serverfrog Every bullet point on this post has lead to a shell - Oracle is not trustworthy. The default for many of the features in the "official" java do not take security into consideration. But if you are a developer, then ignore this post - java gives you extreme power, what could possibly go wrong?
    – rook
    Mar 2, 2017 at 17:23
  • The question was about ways to execute commands without Runtime.getRuntime().exec. At least for deserialization I can say that most gadget ultimately execute a Runtime.getRuntime().exec. Probably the same thing for template injection. And the uploaded war does what? Not execute Runtime.getRuntime().exec()?
    – kaidentity
    Mar 3, 2017 at 7:49
  • Diddn't know about archive directory traversal and NULL byte injection. Thanks rook!
    – ndp
    Mar 3, 2017 at 10:03
  • @kaidentity There is more than one way to skin a cat, and the lion share of shells are obtained through attack chains. Deceptive evaluations - like calls to deserlize() are also more common than processbuilder or runtime.exec
    – rook
    Mar 3, 2017 at 23:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .