domains / families / security / deserialization-insecure

deserialization-insecure

separate

Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar mechanisms that may lead to RCE, file access, or privilege escalation.

When to use

• Java deserialization
• PHP deserialization
• Python pickle abuse
• Gadget chain selection
• Traffic fingerprinting
• Shiro deserialization
• WebLogic deserialization
• Phar deserialization

When not to use

• JNDI injection
• Unauthorized access to common services
• Ghost bits cast attack

Skill page

Source