wh1t3p1g/ysomap

Health v2 · maintenance only

Adoption not part of the score

1247 stars · 149 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Ysomap is a Java deserialization exploit framework that lets users dynamically configure gadget chain payloads with different execution effects. It splits chains into reusable payload and bullet components and supports exploits over RMI, JNDI, JMX, Shiro, and XMLRPC.

Use cases

• generate java deserialization payloads
• test java deserialization vulnerabilities
• exploit jndi and rmi endpoints in authorized pentests
• learn how java deserialization gadget chains work
• craft fastjson or xstream exploit payloads
• run deserialization exploits from a script

When to choose

• you need a flexible, configurable alternative to ysoserial for authorized testing
• you want to swap execution effects (command exec, memory shell, file write) on the same gadget chain
• you need JSON-based chains like fastjson or hessian, not just native serialization
• you want a scriptable exploit workflow for repeated configurations

When to avoid

• you need weblogic or websphere attack packages, which are not yet implemented
• you are not performing authorized security testing - unauthorized use is illegal
• you need a GUI-driven tool, as ysomap is terminal/script based
• you require a stable release cadence, since releases batch up many chain updates

Facets

cli-tool · maturity active

security penetration-testing cli serialization security penetration-testing developer-tools cli cross-platform jvm java-deserialization exploit-framework gadget-chains jndi rmi ysoserial-alternative offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="wh1t3p1g/ysomap")