deserialization-dotnet

To exploit .NET deserialization vulnerabilities for remote code execution, identify vulnerable endpoints and generate payloads using ysoserial.net. This Skill targets ViewState, JSON.NET TypeNameHandling, and BinaryFormatter vectors during authorized penetration tests.

Generate a ViewState exploit payload using a known machine key by leveraging ysoserial.net. This Skill guides crafting and sending malicious signed ViewState data to achieve command execution on the target server.

Vulnerable .NET formatters include BinaryFormatter, SoapFormatter, and JSON.NET using TypeNameHandling with $type properties. Attackers manipulate these formatters to execute gadget chains and achieve remote code execution.

Yes, you need ysoserial.net to exploit .NET deserialization vulnerabilities using this Skill. It is a required dependency for generating exploit payloads for various .NET formatters and gadget chains.

Yes, this Skill supports exploiting JSON.NET TypeNameHandling vulnerabilities. It identifies endpoints accepting JSON data with $type properties and generates payloads to facilitate remote code execution.

Limitations when exploiting .NET deserialization vulnerabilities include requiring knowledge of .NET formatters and gadget chains. This Skill is restricted to authorized penetration tests targeting ViewState, JSON.NET, BinaryFormatter, and SoapFormatter vectors.