exploiting-insecure-deserialization

name	exploiting-insecure-deserialization
description	Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests. Use when working with exploiting insecure deserialization.
domain	cybersecurity
tags	["penetration-testing","deserialization","rce","owasp","web-security","ysoserial"]
subdomain	web-application-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Exploiting Insecure Deserialization

Overview

Cybersecurity skill for exploiting insecure deserialization. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "exploiting insecure deserialization"

• "Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP"

• During authorized penetration tests when applications process serialized data (cookies, API parameters, message queues)

• When identifying Java serialization markers (ac ed 00 05 / rO0AB) in HTTP traffic

• For testing PHP applications that use unserialize() on user-controlled input

• When evaluating .NET applications using BinaryFormatter, ObjectStateFormatter, or ViewState

• During security assessments of applications using pickle (Python), Marshal (Ruby), or YAML deserialization

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Authorization: Written penetration testing agreement with RCE testing scope
• ysoserial: Java deserialization exploit tool (git clone https://github.com/frohoff/ysoserial.git)
• ysoserial.net: .NET deserialization exploit tool (git clone https://github.com/pwntester/ysoserial.net.git)
• PHPGGC: PHP deserialization gadget chain generator (git clone https://github.com/ambionics/phpggc.git)
• Burp Suite Professional: With Java Deserialization Scanner extension
• Java Runtime: For running ysoserial
• Collaborator/interactsh: For out-of-band confirmation of code execution

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": ,
    : ,
    : ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}