ysoserial is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
The tool addresses the security risk posed by Java applications that deserialize untrusted data without proper validation. It works by discovering and chaining together property-oriented programming gadgets found in common Java libraries—sequences of method calls that can be triggered during deserialization to execute arbitrary commands. A user specifies a command and selects a gadget chain, and the tool serializes these into a payload that, when deserialized by a vulnerable application with the required libraries on its classpath, automatically executes that command on the target host. The tool includes gadget chains for libraries such as Apache Commons Collections, Spring Beans and Core, Groovy, and JRE versions up to 1.7u21.
This tool is intended for security researchers, penetration testers, and developers building defensive mechanisms against deserialization attacks. It is most useful for understanding how unsafe deserialization vulnerabilities can be exploited and for testing whether applications properly validate serialized input. The tool makes clear that the vulnerability resides in the application's unsafe deserialization practices, not in the mere presence of gadget libraries on the classpath. Users should be aware that this is explicitly a proof-of-concept and research tool, and the project includes a disclaimer that it is intended only for authorized security testing and academic research.
The project maintains a focused scope on gadget chain discovery and payload generation for Java deserialization exploitation. Development activity shows sustained attention to identifying new gadget chains across different library versions and maintaining compatibility with Java environments.
