A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
ysoserial is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization vulnerabilities. It works by discovering property-oriented programming "gadget chains" in common Java libraries—including Apache Commons Collections, Spring Framework, Groovy, and others—and wrapping user-specified commands within these chains before serializing them to stdout; when a vulnerable application deserializes this data, the chain executes the command on the host. The project is built in Java and requires Java 1.7+ and Maven 3.x+ for building. Originally released by frohoff as part of an AppSecCali 2015 talk, it includes gadget chains for numerous libraries and comes with multiple payload types and exploitation utilities.