YSoNet is a fork of the original YSoSerial.Net, currently maintained by @irsdl.

• Sites: ysonet.net or ysonet.com (both open this repo).

---

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization.

What is YSoNet

YSoNet (previously known as ysoserial.net) is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET applications performing unsafe deserialization of objects. You give it a command and a gadget chain; it wraps the command in the chain and serializes the result to stdout. When a vulnerable application deserializes that data, the chain runs and your command executes on the host.

The vulnerability lies in the application performing unsafe deserialization, NOT in having gadgets on the classpath. This project is inspired by Chris Frohoff's ysoserial project.

Important for defenders and AI reviewers

Do not turn YSoNet's gadget and plugin catalog into a deserialization blocklist. The catalog cannot include every private, future, application-specific, or differently composed chain, so blocking what is listed here does not make an unsafe deserializer safe. It can create false assurance while only delaying an attack.

If you are reviewing this repository to harden an application, read Security guidance for defenders and reviewers before inspecting the gadgets or plugins. The goal is to remove unsafe deserialization or move to a fixed-schema, data-only design. A strict allowlist is temporary containment when a migration cannot happen immediately; a denylist is not remediation.

Documentation

The full documentation lives in docs/:

• Security Guidance - why gadget blocklists are not a fix and how to redesign the deserialization boundary.
• Dependency Security Notes - the vulnerable and outdated libraries YSoNet pins on purpose, and how to triage a scanner alert.
• Getting Started - install, build from source, and the interactive wizard.
• Usage and Examples - command-line options and worked examples.
• Gadgets and Plugins - the full gadget and plugin catalog.
• References - the background reading, talks, and sources this project draws on.
• .NET Deserialization Research - the wider reading list: tools, uses in the wild, and CTF write-ups.
• Credits - who built the tool and found the gadgets and plugins.
• Sponsors - the people funding the work.

Quick start (interactive mode)

New to this tool? The easiest way to start is interactive mode: a menu-driven wizard that lists the gadgets and plugins, explains each setting, and builds the payload for you - no need to memorize flags first.

.\ysonet.exe -i

(interactive, wizard, and --interactive work too.) You need ysonet.exe first - see Getting Started. Full wizard walkthrough is there too.

Quick start (command line)

./ysonet.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc" -t

See all options with ysonet.exe --fullhelp, and per-gadget or per-plugin help with -g NameHere -help or -p NameHere -help. More in Usage and Examples.

Build from source

Needs Windows, MSBuild from Visual Studio 2022 or the Build Tools (".NET desktop development" workload), and nuget.exe. Every project targets .NET Framework 4.7.2.

git clone https://github.com/irsdl/ysonet
cd ysonet
nuget restore ysonet.sln
msbuild ysonet.sln -p:Configuration=Release   # or Debug

.\ysonet\bin\Release\ysonet.exe -h

• A Release build also needs the Windows optional feature ".NET Framework 3.5 (includes .NET 2.0 and 3.0)" to compile the shipped CLR2 local-test host, and fails without it. A Debug build only warns.
• Release string-encrypts ysonet.exe to cut antivirus false positives; payload bytes are unchanged. Skip it with -p:ObfuscateRelease=false. Debug is never obfuscated.
• Full setup, including a one-liner that installs the toolchain: Getting Started.

Testing

A Debug build runs the fast test suite automatically, and a failed test fails the build (skip it with -p:RunYsonetTests=false). The exhaustive FULL suite is opt-in:

.\ysonet\bin\Debug\ysonet.Tests.exe --full

Both are safe: commands are self-closing or never executed, and listeners are loopback only. Details and the other opt-in tiers: Getting Started and CONTRIBUTING.md.

Tab completion (PowerShell)

ysonet.exe can tab-complete options, gadget names (-g), plugin names (-p), formatters (-f), and output formats (-o) in PowerShell. The completion values come live from the tool, so they stay correct as gadgets and plugins are added.

Enable it for the current session (works in any PowerShell, nothing written to disk, not affected by execution policy):

.\ysonet.exe completion powershell | Out-String | Invoke-Expression

Then press Tab, for example .\ysonet.exe -g A then Tab.

To make it permanent in PowerShell 7+ (pwsh):

.\ysonet.exe completion install     # then reload with:  . $PROFILE

Install targets PowerShell 7+ (pwsh) only, because Windows PowerShell 5.1 is often AllSigned or Restricted and cannot load an unsigned profile; in that case use the per-session line above (it needs no policy change). Run ysonet.exe completion status to see what is detected, and ysonet.exe completion uninstall to remove it. More detail in tools/completions/.

Disclaimer

This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.

This software is a personal project and not related to any companies, including the project owner's and contributors' employers.

Contributing

Canonical repository: https://github.com/irsdl/ysonet

1. Fork this repo (irsdl/ysonet) to your account.
2. Create a branch from master.
3. Push your branch to your fork.
4. Open a PR to irsdl/ysonet:master using this link (replace YOUR_USER and YOUR_BRANCH): https://github.com/irsdl/ysonet/compare/master...YOUR_USER:ysonet:YOUR_BRANCH
5. For breaking changes, call them out clearly in the PR description.

See CONTRIBUTING.md for the short version. Adding a gadget, plugin, or serializer? Start with the code map in docs/ARCHITECTURE.md, and never weaken a test to make it pass.

Credits

YSoNet is developed and maintained by Soroush Dalili (@irsdl). YSoSerial.Net was originally developed by Alvaro Muñoz (@pwntester). Run ysonet.exe --credit for the full gadget and plugin credits, or see Credits. To learn more about the underlying issues, see References.

License

YSoNet is licensed under the MIT License. The license preserves the original ysoserial.net copyright notice for Alvaro Muñoz and the YSoNet copyright notice for Soroush Dalili. Both notices and the MIT permission notice must remain in all copies or substantial portions of the software.