ysoserial
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
Checked October 2026.
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
This tool is designed to help developers and security researchers identify and exploit vulnerabilities in Java applications.
ysoserial is a command-line tool that generates payloads for various Java deserialization vulnerabilities, including those in Apache Commons Collections, Apache Commons BeanUtils, and others.
ysoserial is a powerful tool for identifying and exploiting Java deserialization vulnerabilities, and can be used by developers, security researchers, and penetration testers to improve the security of their applications.
ysoserial is available for download on GitHub.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about ysoserial: features, pricing and alternatives.
ysoserial is a product in the Penetration Testing category. It covers Security Research, Vulnerability and Payload Generation.
ysoserial is free. Download and setup instructions are at https://github.com/frohoff/ysoserial/.
Alternatives to ysoserial listed on CybersecTools:
Compare all ysoserial alternatives at https://cybersectools.com/alternatives/ysoserial
ysoserial is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Automate the exploitation of XXE vulnerabilities
A mini webserver with FTP support for XXE payloads
A tool to help exploit XXE vulnerabilities by sending a crafted XML file to the server and parsing it to extract the data.
A payload generator that creates malicious deserialization payloads for testing .NET applications against insecure deserialization vulnerabilities.
Automated pentesting platform for web apps and APIs with AI-driven exploit validation.
A comprehensive database of exploits and vulnerabilities for researchers and professionals
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,033 products.
Connect your AI
