---
id: 4163
title: "GadgetProbe: Exploiting Deserialization to Brute-Force the Remote Classpath"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/gadgetprobe"
published_at: "2020-02-17T00:00:00Z"
tags: ["java", "deserialization", "penetration-testing", "gadget-chain", "tool"]
phying_url: "https://phying.com/item/4163"
lang: en
---

# GadgetProbe: Exploiting Deserialization to Brute-Force the Remote Classpath

## Summary

Bishop Fox's GadgetProbe probes Java deserialization endpoints to enumerate classes and library versions on the remote classpath, helping testers build payloads when ysoserial chains fail blind.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2020-02-17T00:00:00Z
- **Original:** https://bishopfox.com/blog/gadgetprobe
- **Phying News:** https://phying.com/item/4163