pwntester/ysoserial.net

Health v2 · maintenance only

Adoption not part of the score

3782 stars · 524 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

ysoserial.net is a proof-of-concept command-line tool that generates deserialization payloads exploiting unsafe .NET object deserialization using gadget chains from common .NET libraries. It wraps a user-specified command in a chosen gadget chain and serializes it for use in authorized security testing and defensive research.

Use cases

• generate deserialization exploit payloads for .NET applications
• test whether an app is vulnerable to unsafe .NET deserialization
• find gadget chains in common .NET libraries
• demonstrate deserialization vulnerabilities during a pentest
• develop defensive techniques against deserialization attacks
• serialize a command into a specific .NET formatter payload

When to choose

• you are doing authorized penetration testing or security research on .NET applications
• you need to test .NET apps for unsafe deserialization vulnerabilities
• you want a wide collection of .NET gadget chains in one tool

When to avoid

• you need deserialization exploit tooling for Java rather than .NET (use the original ysoserial)
• you want a defensive scanning tool rather than a payload generator
• you lack authorization to test the target system

Facets

cli-tool · maturity active

security penetration-testing vulnerability-scanning serialization cli security penetration-testing reverse-engineering developer-tools windows dotnet cli cross-platform deserialization gadget-chains exploit-payloads dotnet offensive-security ysoserial

Member repositories

For agents

markdown · JSON · MCP: product_card(name="pwntester/ysoserial.net")