Advanced Offensive Security
Insecure Deserialization
Abuse object deserialization to tamper with logic or achieve RCE.
Apps serialize objects to store or transmit them, then deserialize them back. If untrusted data is deserialized, an attacker can craft a malicious object that changes application logic or, with the right 'gadget chain', executes code on the server.
- Java — ysoserial generates gadget-chain payloads for libraries on the classpath.
- PHP — object injection via unserialize() abusing magic methods (__wakeup, __destruct).
- Python — pickle deserialization can run arbitrary code by design.
- .NET — BinaryFormatter / JSON.NET TypeNameHandling gadgets.
// Vulnerable: attacker controls the serialized blob
$obj = unserialize($_COOKIE['data']);
// A crafted object can trigger a magic method that runs code on destruct.