expression-language-injection

1# SKILL: Expression Language Injection — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, `_memberAccess` manipulation, actuator abuse, and real-world CVE chains.
4 
5## 0. RELATED ROUTING
6 
7- [ssti-server-side-template-injection](../ssti-server-side-template-injection/SKILL.md) for template engines (Jinja2, FreeMarker, Twig) — different attack surface
8- [jndi-injection](../jndi-injection/SKILL.md) when EL evaluation leads to JNDI lookup
9 
10**Key distinction**: SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes (`${7*7}`) but diverge in exploitation.
11 
12---
13 
14## 1. DETECTION — POLYGLOT PROBES
15 
16```text
17${7*7}              → 49 = SpEL, OGNL, or Java EL
18#{7*7}              → 49 = SpEL (alternative syntax) or JSF EL
19%{7*7}              → 49 = OGNL (Struts2)
20${T(java.lang.Math).random()}  → random float = SpEL confirmed
21%{#context}         → object dump = OGNL confirmed
22```
23 
24### Disambiguation
25 
26| Response to `${7*7}` | Response to `%{7*7}` | Engine |
27|---|---|---|
28| 49 | literal `%{7*7}` | SpEL or Java EL |
29| literal `${7*7}` | 49 | OGNL (Struts2) |
30| 49 | 49 | Both may be active |
31 
32---
33 
34## 2. SpEL (SPRING EXPRESSION LANGUAGE)
35 
36### Where SpEL Appears
37…