Exploiting Deserialization

Deserialization turns attacker-controlled bytes into live objects with attacker-chosen types. The vulnerability is not the parsing — it is that constructing those objects runs code paths the developer never intended. The work is recognizing the format, then finding a gadget chain in the libraries that happen to be on the classpath.

Only against systems you are authorized to test.

When to Use

• A cookie, parameter, header, or message body contains a serialized object
• You see the magic values listed below in traffic or storage
• Source review finds readObject, unserialize, pickle.loads, Marshal.load, BinaryFormatter, yaml.load, or ObjectInputStream
• A message queue, cache, or session store holds serialized objects
• You need to confirm a suspected blind deserialization