frohoff/ysoserial

Health v2 · maintenance only

Adoption not part of the score

9033 stars · 1859 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

ysoserial is a proof-of-concept command-line tool that generates serialized Java payloads exploiting unsafe object deserialization using gadget chains found in common Java libraries. It wraps a user-specified command in a chosen gadget chain and outputs the serialized object for use in authorized security testing and research.

Use cases

• generate java deserialization exploit payloads
• test applications for unsafe deserialization vulnerabilities
• demonstrate java gadget chain attacks in security research
• verify deserialization defenses against known gadget chains
• learn about java deserialization vulnerabilities
• payload generation for penetration testing java apps

When to choose

• you need to test or demonstrate Java unsafe deserialization vulnerabilities in authorized engagements
• you want a well-known reference tool with gadget chains for many common Java libraries
• you are researching or teaching deserialization attack techniques

When to avoid

• you need a defensive scanning tool rather than payload generation
• your target is not a Java/JVM application
• you lack explicit authorization to test the target system

Facets

cli-tool · maturity active

security penetration-testing vulnerability-scanning serialization cli security penetration-testing developer-tools jvm cli cross-platform java-deserialization gadget-chains exploit-payloads poc-tool security-research jvm

Member repositories

For agents

markdown · JSON · MCP: product_card(name="frohoff/ysoserial")