GrrrDog/Java-Deserialization-Cheat-Sheet resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

3182 stars · 598 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A curated cheat sheet for pentesters and security researchers covering deserialization vulnerabilities across Java/JVM serialization libraries (native serialization, XStream, Jackson, Fast, SnakeYAML, AMF, and more). It aggregates talks, papers, payload generators, exploits, detection tips, and protection guidance.

Use cases

• learn about java deserialization vulnerabilities
• find gadget chains and payload generators for javadeser
• prepare for pentesting java applications with insecure deserialization
• find protection and mitigation advice for java deserialization attacks
• research deserialization flaws in libraries like xstream, jackson, fast, snakeyaml
• detect java deserialization vulnerabilities in a target application

When to choose

• you are a pentester or researcher assessing Java/JVM applications for deserialization flaws
• you need a curated index of talks, tools, and exploits for Java deserialization
• you want guidance on detecting and protecting against insecure deserialization in Java

When to avoid

• you need a runnable scanning or exploitation tool rather than reference material
• you are looking for deserialization vulnerability resources for non-JVM languages
• you need guaranteed up-to-date content, as the sheet is maintained sporadically

Facets

learning-resource · maturity maintenance

security penetration-testing documentation security penetration-testing developer-tools jvm cross-platform cheat-sheet java-deserialization vulnerability-research exploitation awesome-list

Member repositories

For agents

markdown · JSON · MCP: product_card(name="GrrrDog/Java-Deserialization-Cheat-Sheet")