Deserialization: Java - General

https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet

• https://www.synopsys.com/content/dam/synopsys/sig-assets/whitepapers/exploiting-the-java-deserialization-vulnerability.pdf

• https://github.com/frohoff/ysoserial/
• https://github.com/mbechler/marshalsec

• J2EE Scanner
• Backslash Powered Scanner
• Java Deserialization Scanner
• Java Serial Killer
• Java Serialized Payloads

• Chris Frohoff: https://twitter.com/frohoff
  • He is the primary researcher for java deserialization - he wrote ysoserial
• Gabriel Lawrence: https://twitter.com/gebl