| name | web-deserialization |
| description | Insecure deserialization → RCE via gadget chains. Load when the app deserializes attacker data: Java (rO0/AC ED base64), PHP `unserialize` (O:), Python pickle, .NET BinaryFormatter/ViewState, Ruby Marshal/YAML. Signals: serialized blobs in cookies/params, `__VIEWSTATE`, `rO0AB`, `O:8:`.
|
| domain | web |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | critical |
| owasp | ["A08:2021-Software-and-Data-Integrity-Failures"] |
| cwe | ["CWE-502"] |
| tools | ["ysoserial","phpggc","burp"] |
| schema_version | 1 |
Insecure deserialization
When it applies
The app takes serialized objects from the client (cookies, hidden fields, params, message
queues) and deserializes them. Recognizable by format markers.
Why it works
Deserialization reconstructs objects and can invoke their methods (magic methods, readObject,
__wakeup). A crafted object graph ("gadget chain") strings together existing library methods
to reach a dangerous sink — command execution — during/after deserialization.
Method
- Spot the blob & format: Java
rO0AB/AC ED 00 05, PHP O:8:"...":, .NET
__VIEWSTATE/AAEAAAD, Python pickle, Ruby Marshal \x04\x08.
- Confirm it's deserialized untrusted: tamper a byte → parse error/behaviour change.
- Generate a gadget chain with the right tool for a library on the classpath:
- Java:
ysoserial CommonsCollections1 'curl <collab>' | base64
- PHP:
phpggc Monolog/RCE1 system id (pick a gadget matching a loaded framework)
- .NET:
ysoserial.net (ViewState needs the MAC key or MAC-disabled).
- Deliver in the sink; start with an OOB command (
curl/nslookup to your host) as safe proof.
Gotchas
- The chain must match a library actually present (Commons-Collections version, Monolog, etc.) — enumerate dependencies.
- Java: prefer a DNS/OOB gadget to confirm before an RCE payload.
- .NET ViewState needs the machineKey unless MAC validation is off — check for leaked web.config.
Verify success
An OOB callback or command output proving code executed during deserialization.
References
ysoserial / phpggc / ysoserial.net; PortSwigger deserialization labs; OWASP.
