X-GAD
GadgetProbe
Burp extension and Java library that fingerprints which classes sit on a remote Java classpath via blind deserialization, before firing a full gadget chain.
OVERVIEW
GadgetProbe (github.com/BishopFox/GadgetProbe), developed by Bishop Fox's the-bumble, addresses the frustration described in its own README: you found a Java deserialization bug, threw every ysoserial payload at it, and got nothing — was it not exploitable, or just missing the right library? It answers that by generating serialized objects that reference a specific class name and trigger a DNS callback (to Burp Collaborator or your own nameserver) only if that class exists on the remote classpath, without needing that class's full gadget chain to actually complete.
Run through Burp Intruder against a wordlist of class names, or through its Java library/CLI mode for scripted probing, it turns 'is a specific Commons Collections or Jackson version present' into a yes/no answer per class, letting a tester pick the exploitation library, gadget chain, and payload generator — see ysoserial and phpggc, also on this site — most likely to actually work before spending more requests on trial and error.
USE CASES
Practical use cases
- 01
Fingerprinting exactly which serialization libraries (Commons Collections, Jackson, Groovy, etc.) sit on a remote Java classpath.
- 02
Narrowing down which ysoserial or phpggc-style gadget chain is worth trying after a deserialization sink is found but no payload has worked yet.
- 03
Confirming a suspected deserialization sink is real when direct RCE payloads get blocked by a WAF or fail silently.
- 04
Building a version fingerprint of a target's dependencies for the report, even when full RCE isn't achievable.
QUICK START
After finding a Java deserialization sink but before throwing every ysoserial gadget chain at it blind, to confirm which specific libraries are actually present.
- Confirm the target deserializes attacker-controlled input and that a DNS-callback listener (Burp Collaborator or your own domain) is reachable from it.
- Download the GadgetProbe Burp extension release or build it from source with Gradle.
- Send the vulnerable request to Intruder and mark the parameter, then load a class-name wordlist as the payload set.
- Add the GadgetProbe payload processor, plus any encoding processors the sink needs, and run the attack.
- Review which class names triggered a callback in the GadgetProbe tab, then pick a gadget chain that matches.
BEFORE YOU RUN IT
What to check before running it
It confirms presence of a class, not exploitability — a matching class can still be unreachable by any known gadget chain, or patched against the specific technique.
DNS callbacks route through Burp Collaborator or a nameserver you control; treat that infrastructure and its logs as engagement evidence, not scratch tooling.
Large class-name wordlists run through Intruder generate a lot of requests — confirm the target can absorb that volume before running it against production.