ysoserial
Generates Java deserialization payloads from known gadget chains (CommonsCollections, etc.). The reference tool once you spot a Java object sink.
Tags: deserialization, java, gadgets, rce
- Category
- deserialize
- Maintenance signal
- maintained
Use this when: Parsers. A class name is a reference. Do not send a generated object to a host.
Install
release
wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jarCommand templates
Generate gadget
java -jar ysoserial-all.jar {gadget} '{cmd}' | base64