pwntester/ysoserial.net

Features

• Deserialization Vulnerability Testing - Generates malicious serialized objects to test for insecure deserialization vulnerabilities in .NET applications.
• Command Execution Payload Generators - Produces serialized payloads designed to execute system commands on a target machine.
• Deserialization Exploits - Provides a tool for creating malicious serialized objects to exploit unsafe deserialization in .NET applications.
• Gadget Chain Frameworks - Generates sequences of object calls that trigger remote code execution during object reconstruction.
• Gadget Chain Construction - Constructs sequences of existing classes to create executable operations during deserialization.
• Deserialization Payloads - Creates serialized object chains that execute commands when processed during unsafe deserialization.
• Remote Code Execution Testing - Generates payloads that trigger system command execution on a target machine to verify RCE vulnerabilities.
• System Command Execution Payloads - Generates payloads that trigger arbitrary command execution on target machines using specific gadget chains.
• Security Payload Generators - Produces specialized serialized strings to read local files or load remote libraries during security assessments.
• Evasive Payload Optimizations - Reduces the footprint of serialized objects to bypass length constraints or detection mechanisms during delivery.
• Serialized Bytecode Injections - Embeds executable instructions or library references within serialized streams to achieve remote code execution.
• External Payload Integrations - Integrates custom payload logic via a plugin system to produce complex exploit strings.
• Object Graph Manipulations - Structures nested object relationships to control the flow of execution once the target application reconstructs the data.
• Remote Payload Stagers - Produces payloads that force a target application to load a native library from a remote source.
• Security Research Platforms - Develops and tests complex object chains to discover new ways to bypass security filters in .NET formatters.
• Plugin-Based Generation - Extends available exploit types by allowing new gadget chains to be added as modular components.
• Local File Inclusion Payloads - Creates specialized payloads designed to read sensitive files or write data to the target file system.
• Formatter-Specific Serializations - Produces binary or text representations tailored to the specific requirements of various .NET serialization engines.
• Formatter Vulnerability Test Suites - Provides a collection of formatted data strings used to test for vulnerabilities in .NET formatters.
• Security Utilities - Deserialization payload generator for .NET.
• Application Security - Generates deserialization payloads for .NET formatters.
• Deserialization Attacks - Generating payloads for unsafe .NET object deserialization.
• Insecure Deserialization - Payload generator for various .NET deserialization formatters.
• Offensive Security Tools - Payload generator for .NET deserialization vulnerabilities.
• Web Exploitation - Generates payloads for .NET deserialization attacks.

Star history