Later archive addition

Generating deserialization payloads for MessagePack C#’s Typeless mode

Dane Evans · Netwrix

Builds MessagePack Typeless payloads by serializing a surrogate object graph and replacing cached type names with the intended assembly-qualified names. The article explains limitations of serialization hooks and gadget versions, including ObjectDataProvider behavior and XmlResolver settings relevant to XML external entity access.

Record

Researcher

Dane Evans

Published by

Netwrix

In the archive

• Added to the 2023 archive after the original list was published

Related sources

• Generator
• Foundational gadget explanation
• MessagePack payload implementation
• Researcher discussion of limitations

Tags

• dotnet
• deserialization
• gadget-chain
• rce
• xxe
• tooling
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Dane Evans, first published at the original source. Preserved copies are kept so the citation survives its host.