frohoff/ysoserial
Ysoserial
ysoserial is a security research tool and payload generator designed to identify and exploit insecure Java deserialization. It functions as a framework for creating malicious serialized objects that can trigger remote code execution on Java virtual machines.
The project provides a library of known gadget chains, which are sequences of vulnerable class calls that achieve arbitrary command execution during the deserialization process. It automates the generation of these payloads by leveraging common third-party libraries.
The tool covers capabilities for security penetration testing, Java application hardening, and remote code execution research. This includes the ability to generate serialized bytestreams and compose gadget chains to verify if an application's object input validation is correctly implemented.
Features
- Deserialization Vulnerability Testing - Creates malicious serialized objects to test if a Java application is vulnerable to remote code execution.
- Payload Generators - A tool for creating malicious serialized objects that trigger remote code execution via gadget chains in Java applications.
- Malicious Bytestream Generation - Produces binary data representations of object graphs that trigger specific logic when reconstructed by a target JVM.
- Java Security Research Frameworks - Provides a framework for testing Java applications against deserialization vulnerabilities by automating payload generation.
- Remote Command Execution Tools - Generates deserialization gadget chains from common libraries to execute remote commands on target systems.
- Penetration Testing Suites - Generates gadget chains to identify and exploit insecure deserialization flaws during security audits.
- Gadget Chainers - Identifies and links sequences of existing library method calls to achieve arbitrary code execution.
- Deserialization Gadget Libraries - Provides a collection of known vulnerable class sequences used to achieve arbitrary code execution during object deserialization.
- Remote Command Execution - Leverages insecure deserialization to execute system commands on remote Java virtual machines.
- Application Logic Hardening - Helps verify that object input validation and filtering are correctly implemented to prevent command execution.
- Remote Code Execution Research - Studies how common Java libraries can be chained together to trigger unintended behavior on a target system.
- Payload Creation Tools - Provides predefined sequences of method calls for known vulnerable libraries to automate exploit chain creation.
- Reflection-Based Unmarshallers - Uses Java reflection to instantiate and populate classes dynamically without requiring target source code.
- Deserialization Attacks - Generating payloads for unsafe Java object deserialization.
- Deserialization Exploits - Tool for generating Java deserialization payloads.
- Deserialization Tools - Original Java deserialization exploitation tool.
- Insecure Deserialization - Generates payloads for exploiting unsafe Java deserialization.
- Web Exploitation - Generates payloads for Java deserialization attacks.
