Skip to content
YSoNet

Credits

Who built YSoNet and who found the gadgets and plugins it ships. If you want to learn more about .NET deserialization itself, see References and the wider .NET deserialization research list.

YSoNet continues the work of YSoSerial.Net, created by Alvaro Munoz (@pwntester), and its contributors. YSoNet is developed and maintained by Soroush Dalili (@irsdl). The original tool was inspired by Chris Frohoff's ysoserial for Java.

Back to documentation index.

Thanks

Section titled “Thanks”

Special thanks to the creator and contributors of the original ysoserial.net, whose work YSoNet builds on, and to everyone contributing to YSoNet:

Many others have donated their time, added features, and fixed bugs. See the original ysoserial.net contributors and YSoNet contributors.

Thank you to the sponsors whose donations support YSoNet maintenance and AI-assisted security research.

Sponsors

Section titled “Sponsors”

Thank you to everyone who supports the project. Both one-time donations and monthly sponsorships help fund maintenance and AI-assisted security research.

Monthly sponsors

Section titled “Monthly sponsors”

YSoNet has no monthly sponsors yet. If you or your company benefits from the project, please consider becoming a monthly sponsor to support its ongoing work.

Become a monthly sponsor.

One-time sponsors

Section titled “One-time sponsors”

Thank you for your one-time donations:

Make a one-time donation. Every contribution is appreciated.

Gadget and plugin credits

Section titled “Gadget and plugin credits”

The list below is a snapshot. For the current version, run ysonet.exe --credit.

YSoNet tool is being developed and maintained by Soroush Dalili (@irsdl)
YSoSerial.Net has been originally developed by Alvaro Munoz (@pwntester)


Credits for available gadgets:
        ActivitySurrogateDisableTypeCheck
                [Finders: Nick Landers]
        ActivitySurrogateSelector
                [Finders: James Forshaw] [Contributors: Alvaro Munoz, zcgonvh]
        ActivitySurrogateSelectorFromFile
                [Finders: James Forshaw] [Contributors: Alvaro Munoz, zcgonvh]
        AssemblyCatalogLoad
                [Finders: Soroush Dalili]
        AssemblyInstallerLoad
                [Finders: Alvaro Munoz, Oleksandr Mirosh, Piotr Bazydlo] [Contributors: Soroush Dalili]
        AxHostState
                [Finders: Soroush Dalili]
        BaseActivationFactory
                [Finders: Piotr Bazydlo]
        BootstrapperBuilder
                [Finders: Soroush Dalili]
        ClaimsIdentity
                [Finders: Soroush Dalili]
        ClaimsPrincipal
                [Finders: jang]
        ColorConvertedBitmapExtension
                [Finders: Soroush Dalili]
        DataSet
                [Finders: James Forshaw] [Contributors: Soroush Dalili]
        DataSetOldBehaviour
                [Finders: Steven Seeley, Markus Wulftange, Khoa Dinh] [Contributors: Soroush Dalili]
        DataSetOldBehaviourFromFile
                [Finders: Steven Seeley, Markus Wulftange, Khoa Dinh] [Contributors: Soroush Dalili]
        DataSetTypeSpoof
                [Finders: James Forshaw] [Contributors: Soroush Dalili, Markus Wulftange, Jang]
        DataSetXxe
                [Finders: SCRT] [Contributors: Soroush Dalili]
        DataTable
                [Finders: Soroush Dalili]
        DataTableTypeSpoof
                [Finders: Soroush Dalili]
        DataViewManagerXxe
                [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]
        DynamicUpdateMapExtension
                [Finders: Soroush Dalili]
        FileLogTraceListener
                [Finders: Piotr Bazydlo]
        FileSystemInfo
                [Finders: James Forshaw] [Contributors: Soroush Dalili]
        FileSystemInfoTimeSetter
                [Finders: James Forshaw] [Contributors: Soroush Dalili]
        FileSystemProxyCurrentDirectory
                [Finders: Piotr Bazydlo] [Contributors: Soroush Dalili]
        FormsIdentity
                [Finders: Soroush Dalili]
        GenericIdentity
                [Finders: Soroush Dalili]
        GenericPrincipal
                [Finders: Soroush Dalili]
        GetterCompilerResults
                [Finders: Piotr Bazydlo]
        GetterSecurityException
                [Finders: Piotr Bazydlo]
        GetterSettingsPropertyValue
                [Finders: Piotr Bazydlo]
        HashPEFileHandle
                [Finders: Soroush Dalili]
        InfiniteProgressPage
                [Finders: Piotr Bazydlo]
        ObjectDataProvider
                [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Alvaro Munoz, Soroush Dalili, Dane Evans]
        ObjRef
                [Finders: Markus Wulftange]
        PictureBox
                [Finders: Piotr Bazydlo]
        PSObject
                [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Alvaro Munoz]
        ResourceDictionary
                [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]
        ResourceSet
                [Finders: Soroush Dalili]
        ResXFileRef
                [Finders: Soroush Dalili]
        RolePrincipal
                [Finders: Soroush Dalili]
        SessionSecurityToken
                [Finders: @mufinnnnnnn, Soroush Dalili] [Contributors: Soroush Dalili]
        SessionViewStateHistoryItem
                [Finders: Soroush Dalili]
        TempFileCollection
                [Finders: James Forshaw] [Contributors: Soroush Dalili]
        TextFormattingRunProperties
                [Finders: Oleksandr Mirosh and Alvaro Munoz] [Contributors: Oleksandr Mirosh, Soroush Dalili, Piotr Bazydlo]
        ToolboxItemContainer
                [Finders: @frycos]
        TypeConfuseDelegate
                [Finders: James Forshaw] [Contributors: Alvaro Munoz, Soroush Dalili]
        TypeConfuseDelegateFileOperations
                [Finders: James Forshaw] [Contributors: Soroush Dalili]
        TypeConfuseDelegateMono
                [Finders: James Forshaw] [Contributors: Denis Andzakovic, Soroush Dalili]
        TypeConfuseDelegateNetFx35
                [Finders: James Forshaw] [Contributors: Soroush Dalili]
        TypeConfuseDelegateNetFx40
                [Finders: James Forshaw] [Contributors: Soroush Dalili]
        TypeConfuseDelegatePowerShell
                [Finders: James Forshaw, Soroush Dalili] [Contributors: Soroush Dalili]
        WbemClassObjectUnmarshal
                [Finders: James Forshaw, SCRT] [Contributors: Soroush Dalili]
        WindowsClaimsIdentity
                [Finders: Soroush Dalili]
        WindowsIdentity
                [Finders: Levi Broderick] [Contributors: Alvaro Munoz, Soroush Dalili]
        WindowsPrincipal
                [Finders: Steven Seeley of Qihoo 360 Vulcan Team] [Contributors: Chris Anastasio]
        WorkflowDesigner
                [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Alvaro Munoz, Soroush Dalili, Dane Evans]
        WSManPluginInstance
                [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]
        XamlAssemblyLoadFromFile
                [Finders: Soroush Dalili] [Contributors: russtone]
        XamlImageInfo
                [Finders: Piotr Bazydlo]
        XamlTypeConverterFetch
                [Finders: Soroush Dalili]
        XmlDocumentSurrogateXxe
                [Finders: Soroush Dalili]
        XmlDocumentXxe
                [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]


Credits for available plugins:
        ActivatorUrl
                Harrison Neal
        Altserialization
                Soroush Dalili
        ApplicationTrust
                Soroush Dalili
        Clipboard
                Soroush Dalili
        DotNetNuke
                discovered by Oleksandr Mirosh and Alvaro Munoz, implemented by Alvaro Munoz, tested by @GlitchWitch
        GetterCallGadgets
                Piotr Bazydlo
        MachineKeySessionSecurityTokenHandler
                L@2uR1te
        Resx
                Soroush Dalili
        SessionSecurityTokenHandler
                Soroush Dalili
        SharePoint
                CVE-2024-38018: Piotr Bazydlo - explained by Khoa Dinh & implemented by Soroush Dalili, CVE-2025-49704: Khoa Dinh - implemented by Soroush Dalili, CVE-2025-53770: patch bypass of CVE-2025-49704 - implemented by Soroush Dalili, CVE-2026-50522: splitline of DEVCORE Research Team (ZDI-26-412) - implemented by Soroush Dalili, CVE-2018-8421: Soroush Dalili, CVE-2019-0604: Markus Wulftange, CVE-2020-1147: Oleksandr Mirosh, Markus Wulftange, Jonathan Birch, Steven Seeley (write-up)  - implemented by Soroush Dalili
        ThirdPartyGadgets
                Piotr Bazydlo
        TransactionManagerReenlist
                Soroush Dalili
        ViewState
                Soroush Dalili
        Xps
                Soroush Dalili