# WHATPORT(1099)

## NAME

port 1099 — Java RMI registry — The Java RMI registry — a name-to-remote-object lookup that is one of the best-known remote-code-execution surfaces in Java.

Protocol: TCP  
IANA registry

## DESCRIPTION

`rmiregistry` is Java's bootstrap naming service: servers bind remote objects to names, clients look them up and then invoke methods on them. Oracle's tool documentation is explicit that "if the port is omitted, then the registry is started on port 1099." It appears on scans wherever Java server software is deployed — JMX-enabled JVMs, legacy JBoss and WebLogic tiers, Jenkins-era build infrastructure, and monitoring agents. Because lookups and invocations carry serialized Java objects, an exposed registry is the classic target for deserialization gadget-chain attacks; `ysoserial` ships an RMIRegistryExploit specifically for it.

## EXPOSURE

**Do not expose.** An internet-reachable RMI registry is routinely turned into code execution via deserialization gadgets. Bind it to localhost or a management network and reach it over a VPN or SSH tunnel.

## CHECK

```sh
nmap -Pn -p 1099 --script rmi-dumpregistry TARGET
```

## SEE ALSO

- docs — [The rmiregistry Command (Java SE 21 tool specification)](https://docs.oracle.com/en/java/javase/21/docs/specs/man/rmiregistry.html) (docs.oracle.com)
- source — [ysoserial — Java deserialization payload generator (RMIRegistryExploit)](https://github.com/frohoff/ysoserial) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/1099/> · JSON: <https://whatport.net/1099.json> · full dataset: <https://whatport.net/ports.json>