qi4L/JYso

Health v2 · maintenance only

Adoption not part of the score

1761 stars · 191 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

JYso is a Java-based offensive security tool that combines the capabilities of ysoserial (Java deserialization gadget generation) and JNDIExploit (JNDI injection exploitation server). It includes bypasses for high-version JNDI restrictions, WAFs, and RASP, plus memory shell injection features.

Use cases

• generate java deserialization gadget payloads
• exploit jndi injection vulnerabilities
• bypass jndi high version restrictions
• inject memory shells into java middleware
• bypass WAF and RASP during exploitation
• perform shiro deserialization attacks
• set up a malicious ldap or rmi server

When to choose

• you need both ysoserial and JNDIExploit functionality in one tool
• you need to bypass JNDI high-version restrictions or RASP
• you want to deploy memory shells with customizable paths and headers

When to avoid

• you need a defensive security or vulnerability scanning tool
• you are not working with Java deserialization or JNDI attack scenarios
• you need a fully GUI-driven tool (though it does offer GUI)

Facets

cli-tool · maturity active

penetration-testing security security penetration-testing jvm cli cross-platform jndi-injection ysoserial java-deserialization memshell red-team offensive-security exploitation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="qi4L/JYso")