What problem does it solve? Insecure deserialization flaws lead directly to remote code execution but are hard to spot without knowing language-specific serialization signatures and gadget chains. This Skill provides a structured, evidence-gated methodology to identify serialized objects in requests and confirm exploitability with out-of-band callbacks. ## Core Features & Use Cases - Multi-language coverage: Detection patterns and payload generation for Java (ysoserial, Apache Shiro), PHP (phpggc object injection), Python pickle, .NET BinaryFormatter/ViewState, Ruby Marshal, and JNDI/Log4Shell injection. - Phased hunting methodology: Six phases from signal detection (magic bytes like rO0A, rememberMe cookies, __VIEWSTATE) through gadget chain execution and blind RCE confirmation via DNS/HTTP callbacks. - Use Case: During an authorized bug bounty assessment, you notice a Java base64 cookie starting with rO0A. Use this Skill to generate a ysoserial CommonsCollections payload, send it to the endpoint, and confirm code execution through an interactsh callback. ## Quick Start Use the hunt-deserialization skill to test the target application for Java and PHP deserialization vulnerabilities and confirm any findings with an out-of-band callback.
