ysoserial.net is a deserialization payload generator for .NET formatters.
The tool addresses unsafe deserialization vulnerabilities in .NET applications by generating serialized payloads that exploit gadget chains found in common .NET libraries. It works by taking a user-specified command and wrapping it in a chosen gadget chain, then serializing the resulting object. When a vulnerable application deserializes this payload and the required gadgets are present on its classpath, the gadget chain executes automatically, running the attacker's command. The project emphasizes that the vulnerability itself lies in unsafe deserialization practices within applications, not in the presence of gadgets in libraries.
The tool supports multiple .NET serialization formatters including BinaryFormatter, Json.Net, XmlSerializer, and DataContractSerializer, with different gadget chains available for each. It includes a plugin architecture for generating more complex payloads tailored to specific applications like DotNetNuke. Developers working on security research, penetration testing, or defensive measures for .NET applications would find this useful for understanding and testing deserialization vulnerabilities. The project is inspired by the original ysoserial tool for Java.
Development activity shows consistent maintenance with builds tracked across multiple branches, including a dedicated v2 branch with its own build pipeline. The project provides prebuilt binaries through both the releases page and GitHub Actions, making deployment straightforward without requiring compilation from source.
