pwntester/ysoserial.net

ysoserial.net is a security research tool for testing whether .NET applications are vulnerable to a specific class of attack called insecure deserialization. To understand what that means: software often needs to convert data between formats, such as turning a live object in memory into a text or binary format to store it, then converting it back. This conversion back is called deserialization. If an application deserializes data from an untrusted source without proper validation, an attacker can craft a specially shaped input that causes the application to execute code it was never meant to run. The tool generates these malicious inputs, called payloads. A researcher or penetration tester supplies the command they want executed and specifies which .NET serialization format the target application uses, and the tool produces a ready-made payload that can be sent to the application to test whether it is vulnerable. It works across a wide range of .NET serialization formats including BinaryFormatter, Json.NET, DataContractSerializer, SoapFormatter, and others. The payloads rely on what the security field calls "gadget chains." A gadget chain is a sequence of classes that already exist inside common .NET libraries. When an application deserializes the crafted data, these existing classes get called in a specific order that ends with the attacker's chosen command being executed. The vulnerability is in the application's choice to deserialize untrusted data, not in the libraries themselves. The project is documented as a proof-of-concept for academic and defensive security purposes. Its purpose is to help developers and security teams find and fix these vulnerabilities in their own applications before a real attacker does. The authors state it is not intended for attacking systems without authorization. The tool runs on Windows and is built with .NET. Prebuilt binaries are available on the GitHub releases page. Building from source requires Visual Studio and some additional command-line tools. The full README is longer than what was shown.