deserialization-java

Exploit Java deserialization vulnerabilities in web applications and Java-based services.

253|37|Updated Feb 22, 2026

Search Tags:#web security #rce #gadget chain #java deserialization #ysoserial #log4shell

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill deserialization-java

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: deserialization-java
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/deserialization-java
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill deserialization-java

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit Java deserialization vulnerabilities, enabling remote code execution on vulnerable systems.

Core Features & Use Cases

Vulnerability Detection: Identifies Java serialized objects and potential entry points.
Gadget Chain Exploitation: Leverages tools like ysoserial to craft and deliver payloads for RCE.
Framework-Specific Attacks: Includes modules for exploiting vulnerabilities in WebLogic, JBoss, Jenkins, and JSF applications.
Use Case: A penetration tester discovers a web application that deserializes user input. This Skill guides them through detecting the vulnerability, identifying the correct gadget chain, and achieving remote code execution.

Quick Start

Use the deserialization-java skill to exploit a Java deserialization vulnerability on the target URL.

Frequently Asked Questions about deserialization-java

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit Java deserialization vulnerabilities for RCE?▼

To exploit Java deserialization vulnerabilities for remote code execution, identify serialized object entry points, detect available gadget chains using ysoserial, and deliver payloads via protocols like HTTP, RMI, T3, or JMX.

What gadget chains can I use to attack WebLogic or JBoss?▼

For attacking WebLogic or JBoss, you can leverage framework-specific gadget chains using ysoserial and marshalsec to craft payloads that achieve remote code execution through their exposed Java serialization protocols.

How does ysoserial detect and deliver Java deserialization payloads?▼

Ysoserial detects Java deserialization payloads by identifying target serialization formats and generating gadget chains that are delivered over protocols including HTTP, RMI, T3, and JMX to trigger remote code execution.

Can I use this approach to detect and exploit Log4Shell vulnerabilities?▼

Yes, this approach includes specific modules for Log4Shell detection and exploitation, allowing you to identify and attack vulnerable Java-based services alongside standard Java deserialization vulnerabilities.

What is the best way to identify Java serialized objects in web applications?▼

The best way to identify Java serialized objects in web applications is to analyze user input handling for deserialization entry points, then test those entry points with ysoserial-generated payloads to confirm remote code execution.

Does exploiting Java deserialization work over JMX and JSF protocols?▼

Yes, exploiting Java deserialization works over JMX and JSF protocols, as the technique supports delivering remote code execution payloads through HTTP, RMI, T3, JMX, and JSF framework entry points.