> For the complete documentation index, see [llms.txt](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/by-vulnerability/deserialization/by-language/java/resources.md).

# Resources

## Cheatsheets

{% embed url="<https://book.hacktricks.xyz/pentesting-web/deserialization#java-http>" %}

{% embed url="<https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md>" %}

## Ysoserial Bruteforcer

{% embed url="<https://github.com/NickstaDB/SerialBrute/blob/master/SerialBrute.py>" %}

## Articles

{% embed url="<https://twitter.com/jorge_ctf/status/1285240301620273156>" %}

{% embed url="<https://www.coalfire.com/The-Coalfire-Blog/Sept-2018/Exploiting-Blind-Java-Deserialization>" %}

{% embed url="<https://securitycafe.ro/2017/11/03/tricking-java-serialization-for-a-treat/>" %}

{% embed url="<https://blog.netspi.com/java-deserialization-attacks-burp/>" %}

{% embed url="<https://www.thedarksource.com/java-deserialization-vulnerability-detection-and-exploitation-burp-suite/>" %}