Repo brief: frohoff/ysoserial

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T19:09:37.806Z · commit 218bcffcaaa9

Verdict

Mixed — Slowing — last commit 5mo ago

• Last commit 5mo ago
• 26+ active contributors
• MIT licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests

What it is

ysoserial is a proof-of-concept Java tool that generates serialized payloads exploiting unsafe Java object deserialization. It contains 50+ gadget chains (CommonsCollections1-7, Spring, Groovy, BeanShell, Hibernate, etc.) that automatically execute arbitrary commands when deserialized by vulnerable applications. The core capability is wrapping attacker-supplied commands in pre-built gadget chains, serializing them to stdout, and delivering them to applications that unsafely deserialize untrusted data. Monolithic single-jar structure: src/main/java/ysoserial/ contains three entry points (GeneratePayload.java, Serializer.java, Deserializer.java), src/main/java/ysoserial/payloads/ holds 50+…

Start here

Open these first:

• src/main/java/ysoserial/GeneratePayload.java — Main entry point that orchestrates payload generation; every contributor must understand the CLI argument parsing and…
• src/main/java/ysoserial/payloads/ObjectPayload.java — Core interface defining the payload abstraction; all gadget chain implementations extend this and contributors must…
• src/main/java/ysoserial/payloads/util/Gadgets.java — Utility class managing reflection-based gadget chain construction; critical for understanding how payloads leverage library…
• pom.xml — Maven configuration with all payload library dependencies; contributors need to understand version constraints and optional…
• src/main/java/ysoserial/Deserializer.java — Handles deserialization of payloads in testing/verification; essential for understanding the payload execution flow.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone and build with Maven:

git clone https://github.com/frohoff/ysoserial.git
cd ysoserial
mvn clean package -DskipTests
java -jar target/ysoserial-0.0.6-SNAPSHOT-all.jar

This generates the uber-jar and runs the usage message showing all available payload types and their dependencies.

Daily commands:

mvn package -DskipTests
java -jar target/ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections5 'touch /tmp/pwned' | xxd

The first argument is the payload type, the second is the shell command to wrap. Output is binary serialized Java object (suitable for piping to network sockets or files). Use -XDignore.symbol.file to suppress javac war…

…shortened for this brief.

Key cautions & unknowns

• Slowing — last commit 5mo ago
• Concentrated ownership — top contributor handles 70% of recent commits
• Java 1.6 source/target compatibility enforced in pom.xml with -XDignore.symbol.file flag—do not remove this or compiler will fail on internal API usage (e.g., sun.reflect). JDK version mismatch: compiling on Java 8+…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.