mbechler/marshalsec

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

3715 stars · 676 forks observed · 2026-09-21

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

marshalsec is a Java tool and research project that generates exploitation payloads for insecure unmarshalling across many Java marshalling libraries (XStream, Jackson, SnakeYAML, Kryo, Hessian, etc.). It demonstrates how deserialization of attacker-supplied data can lead to remote code execution.

Use cases

• generate deserialization exploit payloads for Java marshallers
• test whether my Java app is vulnerable to unsafe unmarshalling
• research Java deserialization RCE gadgets
• demonstrate JNDI injection / Log4Shell exploitation vectors
• audit third-party marshalling libraries for RCE risks

When to choose

• you are doing security testing or research on Java deserialization vulnerabilities
• you need payload generators for a wide range of Java marshalling frameworks
• you want to verify whether your own systems are exposed to unmarshalling RCE

When to avoid

• you need a general-purpose serialization library for production use
• you want an automated vulnerability scanner rather than a targeted exploitation tool
• your project is not on the Java/JVM platform

Facets

cli-tool · maturity maintenance

security penetration-testing serialization testing security penetration-testing developer-tools jvm cli cross-platform java-deserialization jndi-injection exploitation payload-generation vulnerability-research log4shell

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mbechler/marshalsec")