deserialization-dotnet

Generate ysoserial.net payloads to exploit .NET deserialization vulnerabilities.

253|37|Updated Feb 22, 2026

Search Tags:#.net deserialization #ysoserial.net #dotnet deserialization #BinaryFormatter exploit #ViewState exploit #remote code execution

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill deserialization-dotnet

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: deserialization-dotnet
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/deserialization-dotnet
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill deserialization-dotnet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ysoserial.net, blacklist3r, badsecrets, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit dangerous .NET deserialization vulnerabilities in web applications, enabling remote code execution.

Core Features & Use Cases

Vulnerability Detection: Identifies common .NET deserialization vectors like ViewState, JSON.NET $type properties, and SOAP endpoints.
Payload Generation: Leverages tools like ysoserial.net to create exploit payloads for various .NET formatters.
Exploitation: Guides the user through crafting and sending malicious serialized data to achieve RCE.
Use Case: A penetration tester discovers a web application accepting serialized ViewState data. This Skill assists in generating a signed ViewState payload using known machine keys to gain command execution on the server.

Quick Start

Use the deserialization-dotnet skill to generate a ysoserial.net payload for exploiting a ViewState vulnerability.

Frequently Asked Questions about deserialization-dotnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit .NET deserialization vulnerabilities for remote code execution?▼

To exploit .NET deserialization vulnerabilities for remote code execution, identify vulnerable endpoints and generate payloads using ysoserial.net. This Skill targets ViewState, JSON.NET TypeNameHandling, and BinaryFormatter vectors during authorized penetration tests.

How can I generate a ViewState exploit payload using a known machine key?▼

Generate a ViewState exploit payload using a known machine key by leveraging ysoserial.net. This Skill guides crafting and sending malicious signed ViewState data to achieve command execution on the target server.

What .NET formatters are vulnerable to deserialization attacks?▼

Vulnerable .NET formatters include BinaryFormatter, SoapFormatter, and JSON.NET using TypeNameHandling with $type properties. Attackers manipulate these formatters to execute gadget chains and achieve remote code execution.

Do I need ysoserial.net to exploit .NET deserialization vulnerabilities?▼

Yes, you need ysoserial.net to exploit .NET deserialization vulnerabilities using this Skill. It is a required dependency for generating exploit payloads for various .NET formatters and gadget chains.

Does this Skill support exploiting JSON.NET TypeNameHandling vulnerabilities?▼

Yes, this Skill supports exploiting JSON.NET TypeNameHandling vulnerabilities. It identifies endpoints accepting JSON data with $type properties and generates payloads to facilitate remote code execution.

What are the limitations when exploiting .NET deserialization vulnerabilities?▼

Limitations when exploiting .NET deserialization vulnerabilities include requiring knowledge of .NET formatters and gadget chains. This Skill is restricted to authorized penetration tests targeting ViewState, JSON.NET, BinaryFormatter, and SoapFormatter vectors.