# ysoserial

ysoserial is a Penetration Testing product. It runs on-premises. Pricing is free.

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

Checked October 2026.

## What is ysoserial?

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

This tool is designed to help developers and security researchers identify and exploit vulnerabilities in Java applications.

ysoserial is a command-line tool that generates payloads for various Java deserialization vulnerabilities, including those in Apache Commons Collections, Apache Commons BeanUtils, and others.

ysoserial is a powerful tool for identifying and exploiting Java deserialization vulnerabilities, and can be used by developers, security researchers, and penetration testers to improve the security of their applications.

ysoserial is available for download on GitHub.

Tags: Security Research, Vulnerability, Payload Generation

## Quick facts

- Category: [Offensive Security](https://cybersectools.com/categories/offensive-security-testing) · [Penetration Testing](https://cybersectools.com/categories/pentesting-tools)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 8,501
- Website: github.com

## ysoserial FAQ

### What is ysoserial?

ysoserial is a product in the Penetration Testing category. It covers Security Research, Vulnerability and Payload Generation.

### What is the pricing for ysoserial?

ysoserial is free. Download and setup instructions are at https://github.com/frohoff/ysoserial/.

### What are alternatives to ysoserial?

Alternatives to ysoserial listed on CybersecTools:

1. [COGICEO Pentests](https://cybersectools.com/tools/cogiceo-pentests) - Penetration testing service by French firm COGICEO to find and fix IT security (Commercial)
2. [VinCSS Penetration Testing](https://cybersectools.com/tools/vincss-penetration-testing) (Commercial)
3. [RunSybil](https://cybersectools.com/tools/runsybil) - AI-driven continuous attack surface assessment and validation platform. (Commercial)
4. [Novee AI Pentesting](https://cybersectools.com/tools/novee-ai-pentesting) - AI-driven continuous penetration testing platform with automated remediation. (Commercial)
5. [Tenzai](https://cybersectools.com/tools/tenzai) - Agentic AI platform for continuous, autonomous penetration testing of enterprise apps. (Commercial)

Compare all ysoserial alternatives at [https://cybersectools.com/alternatives/ysoserial](https://cybersectools.com/alternatives/ysoserial)

### What deployment and organization size does ysoserial fit?

ysoserial is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare ysoserial with similar solutions

- [ysoserial vs COGICEO Pentests](https://cybersectools.com/compare/cogiceo-pentests-vs-ysoserial)
- [ysoserial vs VinCSS Penetration Testing](https://cybersectools.com/compare/vincss-penetration-testing-vs-ysoserial)
- [ysoserial vs RunSybil](https://cybersectools.com/compare/runsybil-vs-ysoserial)

All alternatives to ysoserial: [/alternatives/ysoserial](https://cybersectools.com/alternatives/ysoserial)

---

Source: https://cybersectools.com/tools/ysoserial

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on ysoserial: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md