$loading...
It occurs when an application reconstructs an object from attacker-controlled serialized data without validation. During deserialization, magic methods or property setters can fire automatically, letting an attacker chain existing classes (a gadget chain) into actions like remote code execution.
Use a library like ysoserial to produce a payload for a gadget available on the target classpath, such as CommonsCollections, Spring, or URLDNS for blind detection. The generator outputs the matching ysoserial commands so you can pick a chain that fits the libraries the target actually loads.
A PHP property-oriented programming (POP) chain abuses magic methods like __wakeup, __destruct, and __toString in an unserialize() sink, crafting an object string by hand rather than using compiled bytecode. The generator emits both PHP serialized object strings and .NET ysoserial.net formatters for the same idea.
Yes. It is free and runs 100% in your browser, so the exploit commands it generates for Java, PHP, and .NET are never transmitted anywhere. Only run these against applications you have explicit authorization to test.