frohoff/ysoserial
View on GitHub ↗ ★ 9,094 Java
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
8 mentions on Hacker News by 8 people: 1 story, 7 comments · first 2018-05-28 · latest 2025-10-01
20082026
-
…to deserialize arbitrary objects. The actual exploit uses a payload generated by ysoserial ( https://github.com/frohoff/ysoserial ) to either execute a command directly or drop a file on the filesystem. The basic idea behind a…
comment by nneonneo · 2025-10-01 · in Technical Analysis of SAP Exploit Script Used in JLR, Harrods Hacks -
…instantiation or sometimes deconstruction of objects, code can be executed. Popular tool for java: https://github.com/frohoff/ysoserial
comment by lyu07282 · 2025-09-25 · in Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035) -
…more commonly known attack vector for those kind of libraries. I would compare the vulnerability to https://github.com/frohoff/ysoserial .
comment by chromanoid · 2021-12-16 · in Log4j 2.15.0 – Previously suggested mitigations may not be enough -
Exactly. eg. https://github.com/frohoff/ysoserial#usage Note the classes aren't at fault or doing anything wrong (even though you could imagine other mitigations they could use), they are just conveniently there to use if you have a…
comment by znep · 2021-12-15 · in Log4Shell update: second Log4j vulnerability published -
Yes. https://github.com/frohoff/ysoserial https://github.com/pwntester/ysoserial.net
comment by 0x0 · 2020-09-13 · in Bug Larping for Fun and Profit -
…interested in gadget chains for other languages, these Github repos are quite interesting: - Java: https://github.com/frohoff/ysoserial - .NET: https://github.com/pwntester/ysoserial.net - PHP: https://github.com/ambionics/phpggc
comment by pentestercrab · 2018-11-09 · in Ruby 2.x Universal RCE Deserialization Gadget Chain -
…likely never be fixed. It might be considered as a feature from some point of view. Check this out: https://github.com/frohoff/ysoserial My 2 cents: - Secure your sources - Know you format, do not rely on reflection to parse text or binary…
comment by kazra · 2018-05-28 · in Oracle plans to dump risky Java serialization