skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

offensive-deserialization

Identify insecure deserialization sinks and gadget chains across Java, PHP, .NET, and Python.

1|Updated Apr 27, 2026
Search Tags:#web-security#deserialization#security-testing#gadget-chains#pentest-guidance
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-deserialization
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-deserialization
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Red/Skills/offensive-deserialization
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-deserialization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Insecure deserialization creates risk by allowing attackers to manipulate serialized objects, potentially leading to code execution, data exposure, or service disruption. This skill provides a structured checklist to identify sinks, gadget chains, and bypass opportunities across common stacks (Java, PHP, .NET, Python) and to design safe tests.

Core Features & Use Cases

  • Checklist-based discovery: Identify where user-controlled data is deserialized and where unsafe types or polymorphic typing could trigger execution.
  • Gadget chain analysis guidance: Recognize typical gadget chains in popular ecosystems and how to validate mitigations.
  • Safe testing guidance: Plan non-destructive tests and remediation steps for developers and security teams.
  • Use Case: A security engineer reviews an API that processes user-supplied payloads and uses the checklist to map deserialization sinks and potential bypasses.

Quick Start

Begin by mapping the target application's deserialization points to the checklist to identify sinks and potential gadget chains.

Frequently Asked Questions about offensive-deserialization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify insecure deserialization vulnerabilities in Java or PHP applications?▼

To identify insecure deserialization vulnerabilities, map user-controlled data inputs to deserialization sinks using a structured checklist. This Skill guides discovery across Java, PHP, .NET, and Python stacks by locating unsafe types and polymorphic typing that could trigger execution.

What is a deserialization gadget chain and how do I analyze it safely?▼

A deserialization gadget chain is a sequence of methods triggered by manipulated serialized objects leading to code execution. This Skill provides gadget chain analysis guidance to recognize typical chains in popular ecosystems and plan non-destructive, safe testing practices.

How can I test for insecure deserialization without disrupting web services?▼

You can test for insecure deserialization safely by following non-destructive testing guidance provided by this Skill. It helps security engineers plan safe tests and remediation steps, ensuring validation of mitigations without causing service disruption or data exposure.

Does this Skill support finding deserialization sinks across .NET and Python APIs?▼

Yes, this Skill supports finding deserialization sinks across .NET and Python APIs. It applies to Java, PHP, .NET, and Python stacks, guiding the discovery of unsafe deserialization points and potential bypass opportunities in web services and APIs.

What do I need to know to detect insecure deserialization flows in web APIs?▼

Detecting insecure deserialization flows requires knowledge of common deserialization sinks, gadget chains, and safe testing practices. This Skill applies that knowledge to map where user-supplied payloads are processed and identify polymorphic typing risks.

Related Skills

Explore More Software Engineering Skills→
ZateZate
9

vuln-patterns-languages

Detect language-specific vulnerabilities in JavaScript, Python, Go, Java, Ruby, and PHP code.

Community
Advanced
gmcabritagmcabrita
6

wrdn-code-execution

Detect server-side code-execution vulnerabilities by tracking source-to-sink paths across languages.

Community
Advanced
marquesfelipmarquesfelip

deserialization-security

Review Java, Python, PHP, and .NET code for unsafe deserialization patterns.

Community
Advanced
jorgealvesjorgealves
2

python-security-scanner

Detect SQL injections, unsafe deserialization, and hardcoded secrets in Python codebases.

Community
Intermediate