insecure-deserialization

Look for serialized data signatures in user-controlled input: Base64 blobs starting with rO0 or hex ac ed 00 05 for Java, O:<len>:"Class" for PHP, AAEAAAD for .NET, and pickle opcodes for Python. Check cookies, headers, file uploads, and message queues.

ysoserial generates payloads for over 30 Java gadget chains including Apache Commons Collections and Spring. marshalsec and Burp Deserialization Scanner also help detect and exploit vulnerable ObjectInputStream.readObject sinks.

Yes. Kafka, RabbitMQ, and Redis consumers that call pickle.loads or equivalent on queue messages are exploitable if an attacker gains producer access. AWS Lambda and Cloud Functions deserializing S3 or SQS event payloads face similar risks.

Avoid deserializing untrusted input and prefer JSON with strict schemas. Verify integrity with HMAC before deserializing, disable polymorphic typing, use allowlists like Java's ObjectInputFilter, and replace pickle with yaml.safe_load in Python.

Magic methods and constructors such as __reduce__, readObject, and unserialize handlers execute during the deserialization process itself, before the application's business logic or validation code runs. This makes pre-validation integrity checks essential.