Review .NET for BinaryFormatter and typed serializers

Jun 30, 2026 · 1 min read

.NET deserialization gadgets are well developed. Find the dangerous serializers and permissive type handling.

bash

grep -rEn "BinaryFormatter|LosFormatter|NetDataContractSerializer|TypeNameHandling|JavaScriptSerializer" --include=*.cs .

The bug enables type resolution from the payload.

csharp

new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All }; // RCE via $type

Pro note: ysoserial.net generates chains for these sinks, so treat any of them on untrusted input as critical. ViewState (LosFormatter) is exploitable when the machine key is known or weak; check web.config for a static, committed machineKey.