skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-deserialization

Detect and exploit insecure deserialization vulnerabilities across Java, PHP, Python, .NET, Ruby, and JNDI/Log4Shell stacks.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#red team#deserialization#remote code execution#ysoserial#log4shell#php object injection
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-deserialization
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-deserialization
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-deserialization
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-deserialization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Insecure deserialization vulnerabilities across Java, PHP, Python, .NET, Ruby, and JNDI/Log4Shell stacks enable unauthenticated remote code execution, which is almost always rated as critical severity and is frequently missed during standard reconnaissance and vulnerability scanning.

Core Features & Use Cases

  • Multi-stack coverage: Includes detection patterns, exploitation workflows, and gadget chain references for 6 major deserialization vectors: Java ysoserial chains, PHP object injection, Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, and JNDI/Log4Shell.
  • End-to-end hunting workflow: Provides step-by-step guidance for identifying vulnerable endpoints, generating payloads, confirming RCE via out-of-band callbacks, and mapping post-exploitation chains.
  • Use case: During a penetration test of a Java-based enterprise application, use this skill to detect Apache Shiro rememberMe cookies, generate ysoserial CommonsCollections6 payloads, and confirm critical-severity RCE via DNS callbacks to an out-of-band listener.

Quick Start

Use the hunt-deserialization skill to test a target's User-Agent header for Log4Shell JNDI injection and confirm RCE via an out-of-band DNS callback.

Frequently Asked Questions about hunt-deserialization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is insecure deserialization and how does it enable remote code execution?▼

Insecure deserialization occurs when applications process user-controlled serialized objects without validation, enabling unauthenticated remote code execution across Java, PHP, Python, .NET, and Ruby stacks by manipulating framework-specific gadget chains.

How do I test for Log4Shell JNDI injection in HTTP headers?▼

To test Log4Shell JNDI injection, inject JNDI lookup payloads into target headers like User-Agent, then monitor an out-of-band DNS listener for callbacks to confirm unauthenticated remote code execution.

How do I exploit Apache Shiro rememberMe cookies with ysoserial?▼

Exploit Apache Shiro rememberMe cookies by identifying the deserialization endpoint, generating ysoserial CommonsCollections6 payloads, and confirming critical-severity remote code execution via out-of-band DNS callbacks.

Does this deserialization hunting workflow cover PHP object injection and Python pickle RCE?▼

Yes, the workflow covers PHP object injection including PHAR archives, Python pickle RCE, .NET BinaryFormatter, ASP.NET ViewState, and Ruby Marshal.load, providing detection patterns and gadget chain references for each stack.

What is the best way to confirm a deserialization vulnerability during a penetration test?▼

The best way to confirm deserialization vulnerabilities is using out-of-band callback verification, mapping post-exploitation chains after generating framework-specific payloads to validate critical-severity remote code execution.

When should I not use ysoserial gadget chains for deserialization exploitation?▼

Avoid ysoserial gadget chains when target applications lack the required dependency libraries for specific chains, or when blind out-of-band callback infrastructure is unavailable to safely confirm remote code execution.

Related Skills

Explore More Software Engineering Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

reconnaissance

Aggregate subdomains, ports, endpoints, and APIs into structured inventories.

Community
Intermediate
ArianHobson333ArianHobson333
7

reporting

Generate structured exploit reports with CVSS v4.0 scoring and attack path tracking.

Community
Advanced
brucesongsbrucesongs
60

web-deserialization

Detect insecure deserialization vulnerabilities and map gadget chains across Java, PHP, .NET, Python, Ruby, and JSON/XML.

Community
Advanced
wgpsecwgpsec
1.6k

java-deserialization-methodology

Identify Java deserialization weaknesses by analyzing serialized payload markers and middleware exposure.

Official
Advanced