ysoserial.net

Tech stack & purpose

ysoserial.net is a proof-of-concept tool for generating deserialization payloads that exploit unsafe .NET object deserialization vulnerabilities. The project collects property-oriented programming gadget chains discovered in common .NET libraries, allowing users to specify a command and gadget chain, which the tool then serializes for delivery to vulnerable applications. Built in C# using .NET technologies like BinaryFormatter, various serializers (Json.NET, DataContractSerializer, XAML), and supporting multiple formatters and gadget variants, ysoserial.net is inspired by Chris Frohoff's original ysoserial project and maintained as a personal project by its author, pwntester.

Community & reference links

• Friday the 13th: JSON Attacks - Video(demos)
• www.youtube.com/watch?v=ZcOZNAmKR0c&feature=youtu.be

Languages

Contributors (top 30 of 40)

• Soroush Dalili132 commits
• Alvaro Muñoz75 commits
• Alvaro42 commits
• pwntester28 commits
• Alvaro Muñoz25 commits
• Jeffrey Cap8 commits
• chudyPB6 commits
• jl5 commits
• zcgonvh4 commits
• shelld3v4 commits
• testanull4 commits
• Anton Prokhorov4 commits
• Nines4 commits
• Markus Wulftange3 commits
• BuildTools3 commits
• Cyku3 commits
• Ricter Zheng2 commits
• Dane Evans2 commits
• Nick Landers2 commits
• munoza2 commits
• 23086525122 commits
• DoI2 commits
• Frycos2 commits
• 
  Kurt Boberg2 commits · 13 followers
• yallie2 commits
• Philippe Arteau1 commits
• Harrison Neal1 commits
• idealphase1 commits
• Y4er1 commits
• Ryan Emmons1 commits