Deserialization Gadget Visualizer
Insecure deserialization, made visual. Trace gadget chains from entry point to RCE sink, and disassemble serialized blobs byte by byte — all in your browser.
🛡 Parses & visualizes only · never deserializes or executes · works offline 1
Gadget-chain explorer
Well-known deserialization gadget chains, drawn as node graphs: entry point → trigger/gadget methods → reflection transforms → the RCE sink. Pick a chain, then click any node to see what that hop does and why it's reachable.
Click a node in the graph to see what that step does.
2
Serialization-stream inspector
Paste a serialized blob and it's parsed locally into a readable tree. This tool only reads the wire format — it never deserializes the data or executes anything in it.
🛡 Parsed locally in your browser — nothing is deserialized or executed.