The Java RMI registry — a name-to-remote-object lookup that is one of the best-known remote-code-execution surfaces in Java.
rmiregistry is Java's bootstrap naming service: servers bind remote objects to names, clients look them up and then invoke methods on them. Oracle's tool documentation is explicit that "if the port is omitted, then the registry is started on port 1099." It appears on scans wherever Java server software is deployed — JMX-enabled JVMs, legacy JBoss and WebLogic tiers, Jenkins-era build infrastructure, and monitoring agents. Because lookups and invocations carry serialized Java objects, an exposed registry is the classic target for deserialization gadget-chain attacks; ysoserial ships an RMIRegistryExploit specifically for it.
Do not expose
An internet-reachable RMI registry is routinely turned into code execution via deserialization gadgets. Bind it to localhost or a management network and reach it over a VPN or SSH tunnel.
$ nmap -Pn -p 1099 --script rmi-dumpregistry TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.