domains / families / security / hunt-deserialization

hunt-deserialization

combined

Hunt Insecure Deserialization Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

Both copies share the same core procedure (Java ysoserial, PHP phpggc, Python pickle, .NET ViewState, Log4Shell/JNDI, Ruby Marshal) and the same detection signals. The sickn33 copy adds a mandatory authorization gate and extra deserialization vectors (PHP phar://, Python yaml.load, Node node-serialize) that the uphiago copy lacks. The uphiago copy adds a Verification section and slightly different curl timeout flags. Crowning one would hide the authorization gate and the extra vectors, so the copies should be combined.