Hacker GitHub

← All repos

frohoff/ysoserial

View on GitHub ↗ ★ 9,094 Java

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

8 mentions on Hacker News by 8 people: 1 story, 7 comments · first 2018-05-28 · latest 2025-10-01

Mentions per year 8 mentions · busiest year 2018 (2)
20082026
AllStoriesComments NewestTopOldest
  1. …to deserialize arbitrary objects. The actual exploit uses a payload generated by ysoserial ( https://github.com/frohoff/ysoserial ) to either execute a command directly or drop a file on the filesystem. The basic idea behind a…
    comment by nneonneo · 2025-10-01 · in Technical Analysis of SAP Exploit Script Used in JLR, Harrods Hacks
  2. …instantiation or sometimes deconstruction of objects, code can be executed. Popular tool for java: https://github.com/frohoff/ysoserial
    comment by lyu07282 · 2025-09-25 · in Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)
  3. ▲ 1
    PoC tool for creating payloads that exploit unsafe Java object deserialization
    story by saikatsg · 2022-08-29 · 1 comment
  4. …more commonly known attack vector for those kind of libraries. I would compare the vulnerability to https://github.com/frohoff/ysoserial .
    comment by chromanoid · 2021-12-16 · in Log4j 2.15.0 – Previously suggested mitigations may not be enough
  5. Exactly. eg. https://github.com/frohoff/ysoserial#usage Note the classes aren't at fault or doing anything wrong (even though you could imagine other mitigations they could use), they are just conveniently there to use if you have a…
    comment by znep · 2021-12-15 · in Log4Shell update: second Log4j vulnerability published
  6. Yes. https://github.com/frohoff/ysoserial https://github.com/pwntester/ysoserial.net
    comment by 0x0 · 2020-09-13 · in Bug Larping for Fun and Profit
  7. …interested in gadget chains for other languages, these Github repos are quite interesting: - Java: https://github.com/frohoff/ysoserial - .NET: https://github.com/pwntester/ysoserial.net - PHP: https://github.com/ambionics/phpggc
    comment by pentestercrab · 2018-11-09 · in Ruby 2.x Universal RCE Deserialization Gadget Chain
  8. …likely never be fixed. It might be considered as a feature from some point of view. Check this out: https://github.com/frohoff/ysoserial My 2 cents: - Secure your sources - Know you format, do not rely on reflection to parse text or binary…
    comment by kazra · 2018-05-28 · in Oracle plans to dump risky Java serialization