| name | hunt-deserialization |
| description | Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output. |
Hunt: Insecure Deserialization
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "insecure deserialization gadget chain Java .NET PHP Python Ruby Node ysoserial" via wiki-search MCP
Hub: [[web-moc]] (live web index). Primary page: [[insecure-deserialization]]. Payload arsenal: wiki/payloads/deserialization.md.
Anchors: [[ml-model-deserialization]].
Confirmation gate
Blind deserialization RCE claims require an OOB HIT. No exceptions. The first payload is always
a benign OOB probe, never a command: Java URLDNS / JRMPClient force a DNS/TCP callback with zero
code-exec risk, proving the sink deserializes attacker data before you fire a gadget.
NOT confirmation: a deserialization error, a type error, a stack trace, a 500, or the blob
merely being accepted. Any of these alone means the parser saw your bytes, not that you control
execution.
IS confirmation: an OOB callback from the gadget to your unique Collaborator / interactsh
subdomain, or a demonstrated effect - command execution, a file read, an SSRF fetch - reproduced in
a clean session per hunt-core. A time-delay gadget that reliably toggles counts as the effect.
Blind cases need the OOB HIT.
When you plant the OOB probe (URLDNS/JRMPClient or any blind payload), append a row to
targets/<eng>/oob.md: | <token> | <sink url+param> | deser | <date> | waiting | | (columns:
token | sink | class | planted | status | source, token = your unique interactsh label). The
recon-capture hook auto-correlates incoming callbacks to flip the row to HIT and SessionStart
surfaces HITs; the HIT row is the gate to scaffold the FIND. Do NOT claim a blind deserialization
finding without a HIT row.
