ysoserial.net v1.35 releases: Deserialization payload generator for a variety of .NET formatters
A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization.
ysoserial.net is a collection of utilities and property-oriented programming “gadget chains” discovered in common .NET libraries that can, under the right conditions, exploit .NET applications performing unsafe deserialization of objects. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes this data, the chain will automatically be invoked and cause the command to be executed on the application host.
It should be noted that the vulnerability lies in the application performing unsafe deserialization and NOT in having gadgets on the classpath.
This project is inspired by Chris Frohoff’s ysoserial project
This software has been created purely for the purposes of academic research and for the development of effective defensive techniques and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.
This software is a personal project and not related to any companies, including Project owner and contributors employers.
- bug fix + a few changes to existing modules by @irsdl in #93
- bug fixing + readme update by @irsdl in #95
- readme update by @irsdl in #96
- Add ToolboxItemContainer Bridge Gadget by @Frycos in #97
- Update SerializersHelper.cs by @irsdl in #98
- Add installation guide by @shelld3v in #100
- Typo fix: “poayloads” to “payloads” by @the-emmon in #106
- fix bug of xaml for SharePoint CVE-2019-0604 by @Y4er in #107
- Add ClaimsPrincipal and modify TypeConfuseDelegate by @testanull in #110
- Update DotNetNuke README to reflect actual output by @martinvw in #112
- Add IsolateApps supports by @RicterZ in #113
- Add ObjRef gadget by @mwulftange in #115
- Add dataset type spoofing by @testanull in #120
- Update README.md by @irsdl in #123
- update by @irsdl in #124
- url encode feature + save to file by @irsdl in #125
Copyright (c) 2017-2019 Alvaro Muñoz