# Resources

## Cheatsheets

{% embed url="https://book.hacktricks.xyz/pentesting-web/deserialization#java-http" %}

{% embed url="https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md" %}

## Ysoserial Bruteforcer

{% embed url="https://github.com/NickstaDB/SerialBrute/blob/master/SerialBrute.py" %}

## Articles

{% embed url="https://twitter.com/jorge_ctf/status/1285240301620273156" %}

{% embed url="https://www.coalfire.com/The-Coalfire-Blog/Sept-2018/Exploiting-Blind-Java-Deserialization" %}

{% embed url="https://securitycafe.ro/2017/11/03/tricking-java-serialization-for-a-treat/" %}

{% embed url="https://blog.netspi.com/java-deserialization-attacks-burp/" %}

{% embed url="https://www.thedarksource.com/java-deserialization-vulnerability-detection-and-exploitation-burp-suite/" %}

