# wh1t3p1g/ysomap

A helpful Java Deserialization exploit framework.

Repository: https://github.com/wh1t3p1g/ysomap
Canonical: https://ross.abutalabs.com/products/ysomap
Language: Java
License: Apache-2.0
License Family: permissive
Topics: java-deserialization, exploitation-framework
Last push: 2025-02-17T06:35:51+00:00

## Health v2 (maintenance only)
Score: 26/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 7, release rhythm 8, longevity 100
- inputs: {"age_days": 2398, "days_push": 562, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1247, forks 149 (observed 2026-08-28T04:04:07.568935+00:00)

## What it is
Ysomap is a Java deserialization exploit framework that lets users dynamically configure gadget chain payloads with different execution effects. It splits chains into reusable payload and bullet components and supports exploits over RMI, JNDI, JMX, Shiro, and XMLRPC.

## Use cases
- generate java deserialization payloads
- test java deserialization vulnerabilities
- exploit jndi and rmi endpoints in authorized pentests
- learn how java deserialization gadget chains work
- craft fastjson or xstream exploit payloads
- run deserialization exploits from a script

## When to choose
- you need a flexible, configurable alternative to ysoserial for authorized testing
- you want to swap execution effects (command exec, memory shell, file write) on the same gadget chain
- you need JSON-based chains like fastjson or hessian, not just native serialization
- you want a scriptable exploit workflow for repeated configurations

## When to avoid
- you need weblogic or websphere attack packages, which are not yet implemented
- you are not performing authorized security testing - unauthorized use is illegal
- you need a GUI-driven tool, as ysomap is terminal/script based
- you require a stable release cadence, since releases batch up many chain updates

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, cli, serialization
- domain: security, penetration-testing, developer-tools
- platform: cli, cross-platform, jvm
- tags: java-deserialization, exploit-framework, gadget-chains, jndi, rmi, ysoserial-alternative, offensive-security

## Member repositories
- wh1t3p1g/ysomap (main) score 26

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:07.568935+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:07:59.650245+00:00, confidence not recorded.
  - readme: https://github.com/wh1t3p1g/ysomap (fetched 2026-08-28T04:04:07.568935+00:00, sha 8f6539e982aa)
- Data as of 2026-08-30T08:39:29.467469+00:00.