ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. (by frohoff)

Ysoserial Alternatives

Similar projects and alternatives to ysoserial

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a better ysoserial alternative or higher similarity.

ysoserial reviews and mentions

Posts with mentions or reviews of ysoserial. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2022-12-23.
  • Java deserialization payloads in log4j (Unified starting point)
    3 projects | /r/hackthebox | 23 Dec 2022
    So I've finished the unified box in stage 2 of the starting point and have tons of questions about the box. In the box they use veracode-research/rogue-jndi to exploit the log4j vulnerability. But when I test it with deserialize payload generated by frohoff/ysoserial it's not running. I've try to look at the java log in the challenge container but can't find anything that java complain or error out. Is it because the ysoserial payload too complex that it running but fail at some point and don't throw error or maybe the author just hard code so that only the payload from rogue-jndi work? can it's because of the java version/framework/library/weirdness? Do I need to test both kind of payload if I want to exploit log4j in the future or just stick with pimps/JNDI-Expoit-Kit or cckuailong/JNDI-Injection_Exploit-Plus (my senior recommendation when exploiting log4j).
  • An Unsafe Deserialization Vulnerability and Types of Deserialization
    2 projects | dev.to | 10 Dec 2022
    GitHub - Ysoserial
  • Great Time at JavaZone 2022
    3 projects | dev.to | 14 Sep 2022
    A gadget lets you run load a different class upon serialization. This will fail later when we downcast but during the read process we can load a different class where we can do arbitrary code execution. HashMap is a class that overrides the readObject and can be used as part of an exploit chain. ysoserial helps us create a chain of serialization to produce an exploit based on known serialization weaknesses. You can run this project and generate payload ser files that you can pass to exploit potential vulnerabilities.
  • Is Haskell a Good Choice for Software Security?
    2 projects | news.ycombinator.com | 17 Dec 2021
    > A similar issue has occurred with Java (and other languages, see https://frohoff.github.io/appseccali-marshalling-pickles/). Java provided a suberbly user-friendly way of serializing any object to disk and recovering it back in its original form. The only unfortunate problem was that there was no way to say which object you are expecting! This allows attackers to send you objects that, upon deserialization in your program, become nasties that wreak havoc and steal data.

    Not correct. You can certainly inspect before instantiation:

    https://docs.oracle.com/javase/7/docs/platform/serialization...

  • Log4j 2.15.0 – Previously suggested mitigations may not be enough
    7 projects | news.ycombinator.com | 16 Dec 2021
    Mmh, I don't think so. Beside logging most other libraries will already sanitize user input since it is a more commonly known attack vector for those kind of libraries. I would compare the vulnerability to https://github.com/frohoff/ysoserial.
  • Analysis of the 2nd Log4j CVE published earlier (CVE-2021-45046 / Log4Shell2)
    11 projects | news.ycombinator.com | 14 Dec 2021
    Exactly. eg. https://github.com/frohoff/ysoserial#usage

    Note the classes aren't at fault or doing anything wrong (even though you could imagine other mitigations they could use), they are just conveniently there to use if you have a vulnerability that lets you de-serialize untrusted data.

  • RCE 0-day exploit found in log4j, a popular Java logging package
    9 projects | /r/programming | 9 Dec 2021
    This has been known for a zillion years and has caused a zillion CBEs, so at this point there are off-the-shelf tools like ysoserial that take your payload and wrap it into an object that kabooms when deserialized, with like 20 different choices of methods depending on what dangerous objects are available on the target's classpath for deserialization.
  • Why JEP 411 Will Have a Negative Impact on Java Security
    3 projects | /r/java | 24 May 2021
    I think a mistake many people make, is they assume it's for untrusted code or applets or something along those lines, but this completely ignores access controls, besides signed applets were given AllPermission, which was just nuts in my opinion. If you read Li Gong's book "Inside Java 2 Platform Security, Second Edition", he informs the reader that remote data which has the capability to modify state, should be treated the same as code, when you take that perspective, it means that Java Serialization and XML parsers should have had an unprivileged domain placed onto the call stack, to represent untrusted data. Java Serialization was designed a long time ago, I noticed even tonight a new gadget attack was posted against Java Serialization. https://github.com/frohoff/ysoserial/commit/d367e379d961c18bff28fd2c888a2c8fe0dc6e63#commitcomment-51212711
  • A note from our sponsor - SaaSHub
    www.saashub.com | 29 Mar 2024
    SaaSHub helps you find the best software and product alternatives Learn more →

Stats

Basic ysoserial repo stats
13
7,198
0.0
9 days ago
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com