Insecure Deserialization
A serialized blob in a cookie or parameter is a gadget. RCE depends on the classes in the classpath.
Tags: deserialize, rce, java, php, python
Level: advanced
Method
Find the blobs
Java (rO0), PHP (O:), Python pickle (gASV), .NET, Ruby Marshal, YAML, JSON with typed objects (Jackson @type, GSON).
Tools: Burp Suite
Identify the stack
Headers, errors, cookies, JS. Do not throw ysoserial at a PHP app.
Safe detect
Time delay or DNS canary gadgets first. Do not run calc.exe on production.
Tools: ysoserial, interactsh
Field notes
- ViewState without a MAC on old ASP.NET is the same class of bug.
- SnakeYAML, Python yaml.load, and PHP phar deserialization are the common 2024-26 leftovers.