ysoserial

name	ysoserial
description	Java deserialization payload generator for common gadget chains (CommonsBeanutils, CC1-CC6). Used as a helper skill to produce serialized Java payloads for delivery via other exploit skills.
metadata	{"openclaw":{"emoji":"🔧","requires":{"bins":["java"],"env":[]},"primaryEnv":null}}

ysoserial

Generates serialized Java deserialization payloads using ysoserial for a range of common gadget chains.

Target Framework

Any Java application with a vulnerable deserialization endpoint and one of: Commons Collections 1-6, Commons BeanUtils 1, Spring, Groovy, or other supported gadget chain libraries.

Usage

Provide params.chain (gadget chain name) and params.cmd (command to embed). Returns a base64-encoded serialized payload ready for delivery.

Parameters

Param	Type	Required	Description
chain	string	yes	Gadget chain name (e.g. CommonsBeanutils1, CC6)
cmd	string	yes	OS command to embed in the payload
format	string	no	Output format: base64 (default) or raw
timeout	int	no	Timeout in seconds (default: 30)

Notes

Commonly paired with shiro_exploit, exploit-weblogic, or any raw deserialization endpoint. The generated payload must be delivered over the appropriate protocol (HTTP body, cookie, T3, etc.).