ysoserial

A proof-of-concept Java CLI that emits serialized object payloads using gadget chains in common Java libraries. When a receiving Java application unsafely deserializes a payload containing a gadget present on its classpath, the chain can execute the supplied command in the application's process context. Payload generation alone does not establish that a target is vulnerable.