(Ideally I'd start a discussion for this, but I don't believe that's enabled for this repository.)
Currently Ysoserial.NET primarily works to support generation of gadget payloads that execute a command on deserialization. There are some exceptions to this rule as some gadgets allow you to specify files and there is a plugin option to handle special cases for specific technologies.
I've been doing quite a lot of research recently into different types of gadgets that would allow a researcher to generate payloads that can perform other useful actions, such as exfiltrating files via XXE gadget chains during deserialization. I've even got a PoC that works on .NET Core and .NET 7, utilizing the serializer to bypass the default XML parsing security configurations introduced in .NET 4.5.2.
I believe there is probably some interest in being able to generate these, but I'm not sure what the consensus would be on how to approach it with respect to listing the gadgets and avoiding cluttering the command line options.
(Ideally I'd start a discussion for this, but I don't believe that's enabled for this repository.)
Currently Ysoserial.NET primarily works to support generation of gadget payloads that execute a command on deserialization. There are some exceptions to this rule as some gadgets allow you to specify files and there is a plugin option to handle special cases for specific technologies.
I've been doing quite a lot of research recently into different types of gadgets that would allow a researcher to generate payloads that can perform other useful actions, such as exfiltrating files via XXE gadget chains during deserialization. I've even got a PoC that works on .NET Core and .NET 7, utilizing the serializer to bypass the default XML parsing security configurations introduced in .NET 4.5.2.
I believe there is probably some interest in being able to generate these, but I'm not sure what the consensus would be on how to approach it with respect to listing the gadgets and avoiding cluttering the command line options.