php-serialize-audit

To audit PHP deserialization vulnerabilities, you need to identify `unserialize()` and `Phar://` triggers, trace user-controlled input to these sinks, and analyze magic methods for POP chain construction. This process pinpoints potential Remote Code Execution risks.

A Phar deserialization vulnerability triggers when operations using the `Phar://` wrapper access a crafted archive, automatically deserializing its metadata. Auditing detects `Phar://` usage and checks if user input controls the file path to reach the sink.

Tracing input controllability to PHP deserialization sinks involves following data flow from request inputs to vulnerable functions. The audit records evidence chains to confirm whether attacker-controlled data reliably reaches `unserialize()`.

Yes, analyzing PHP magic methods like `__wakeup` and `__destruct` allows you to construct potential POP chains. The audit identifies these methods to map how properties propagate through classes to achieve code execution.

You can report PHP deserialization findings in structured JSON and Markdown formats. The audit documents the complete evidence chain, controllability analysis, and vulnerability details to generate comprehensive reports.

Automatic auditing of PHP deserialization vulnerabilities may face limitations with complex or obfuscated POP chains where data flow is difficult to trace. It primarily focuses on identifying `unserialize()` and `Phar://` triggers, which might miss deeply nested execution paths.