deserialization-php

Exploit PHP deserialization vulnerabilities via PHPGGC gadget chains and PHAR streams.

253|37|Updated Feb 22, 2026

Search Tags:#php #deserialization #rce #phpggc #phar #gadget chain

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill deserialization-php

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: deserialization-php
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/deserialization-php
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill deserialization-php

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit PHP deserialization vulnerabilities, which can lead to remote code execution.

Core Features & Use Cases

Identify Serialization Formats: Detects common PHP serialization patterns (objects, arrays, strings).
Exploit Gadget Chains: Leverages tools like PHPGGC to generate and inject malicious payloads using known framework vulnerabilities.
PHAR Deserialization: Exploits vulnerabilities where PHP filesystem functions process PHAR archives.
Use Case: A penetration tester finds an application that unserializes user-provided data. They use this Skill to craft a payload that executes arbitrary commands on the server.

Quick Start

Use the deserialization-php skill to generate a PHPGGC RCE1 chain for Monolog and execute the 'id' command, outputting the result as a base64 encoded string.

Frequently Asked Questions about deserialization-php

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit PHP deserialization vulnerabilities for remote code execution?▼

To exploit PHP deserialization vulnerabilities for remote code execution, you need to identify untrusted data passed to the unserialize() function or phar:// streams, then leverage known gadget chains via tools like PHPGGC to inject malicious payloads and execute arbitrary commands on the server.

What is a gadget chain in PHP deserialization attacks?▼

A gadget chain in PHP deserialization attacks is a sequence of methods within target frameworks or libraries that are triggered when untrusted data is unserialized. Tools like PHPGGC generate these chains to manipulate application logic and achieve remote code execution.

How does PHAR deserialization work when PHP filesystem functions process archives?▼

PHAR deserialization occurs when PHP filesystem functions process PHAR archives via phar:// streams, automatically unserializing the archive's metadata. This allows attackers to trigger gadget chains for remote code execution without directly calling the unserialize() function.

Do I need to know the target framework to use PHPGGC for generating payloads?▼

Yes, exploiting PHP deserialization vulnerabilities with PHPGGC requires knowledge of the target framework and its libraries. This prerequisite knowledge is necessary to select the correct gadget chain that will successfully execute during the unserialization process.

Can I use Burp Suite to test for PHP deserialization vulnerabilities?▼

Yes, you can use Burp Suite to test for PHP deserialization vulnerabilities by intercepting and modifying requests to inject untrusted data into unserialize() parameters or phar:// streams, then observing the application's response for successful remote code execution.

What is the best way to identify PHP serialization formats in user-provided data?▼

The best way to identify PHP serialization formats in user-provided data is to look for common serialization patterns such as PHP objects, arrays, and strings within request parameters or cookies. Recognizing these formats is the first step before attempting to exploit the deserialization vulnerability.