So @irsdl@infosec.exchange released a new version of YSoNet (a forge of ysoserial.net), with some cool new features / gadgets: ▸ DataTable + DataTableTypeSpoof Same-graph DataTable root carrier for RCE. No nested BinaryFormatter or extra binder boundary. TypeSpoof emits a real DataTable subclass, so blocking only the exact DataTable wire name may not prevent reconstruction. ▸ TypeConfuseDelegateFileOperations Five delegate-confusion variants for writing, copying, moving and truncating files. No child process, compiler or WPF required. ▸ AssemblyInstallerLoad Loads a specified DLL from a local or UNC path and instantiates [RunInstaller(true)] installer types. Supported by nine serializers. ▸ DynamicUpdateMapExtension Passes x:XData to NetDataContractSerializer without a binder, allowing a XAML-only sink to carry an NDCS gadget. 🔧 NOTABLE UPDATES ▸ TypeConfuseDelegate now supports SortedDictionary and TreeSet roots, useful for testing blocklists that match only the exact SortedSet wire name. ▸ WindowsIdentity and WindowsClaimsIdentity can carry the inner BinaryFormatter graph through actor, bootstrapContext, claims or WIF’s _actor sink. Variant numbering is now aligned across both gadgets and all serializers. 🔗 https://github.com/irsdl/ysonet http://ysonet.com | http://ysonet.net #AppSec #YSoNet