Spencer McIntyre

YSoNet v2026.7.9 is out 🎉 31 → 50 gadgets 54 → 88 variants 118 → 235 gadget/serializer combinations across 17 serializers 🆕 NEW GADGETS WORTH KNOWING ▸ DataTable + DataTableTypeSpoof Same-graph DataTable root carrier for RCE. No nested BinaryFormatter or extra binder boundary. TypeSpoof emits a real DataTable subclass, so blocking only the exact DataTable wire name may not prevent reconstruction. ▸ TypeConfuseDelegateFileOperations Five delegate-confusion variants for writing, copying, moving and truncating files. No child process, compiler or WPF required. ▸ AssemblyInstallerLoad Loads a specified DLL from a local or UNC path and instantiates [RunInstaller(true)] installer types. Supported by nine serializers. ▸ DynamicUpdateMapExtension Passes x:XData to NetDataContractSerializer without a binder, allowing a XAML-only sink to carry an NDCS gadget. 🔧 NOTABLE UPDATES ▸ TypeConfuseDelegate now supports SortedDictionary and TreeSet roots, useful for testing blocklists that match only the exact SortedSet wire name. ▸ WindowsIdentity and WindowsClaimsIdentity can carry the inner BinaryFormatter graph through actor, bootstrapContext, claims or WIF’s _actor sink. Variant numbering is now aligned across both gadgets and all serializers. 🔗 github.com/irsdl/ysonet ysonet.com | ysonet.net #AppSec #YSoNet