skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vuln-deserialization

Detect insecure deserialization vulnerabilities using time-based oracles across Java, PHP, Python, .NET, and Node.js.

Updated Jul 30, 2026
Search Tags:#security#vulnerability#pentest#deserialization#rce#gadget-chain
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-deserialization-salmanabdurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-deserialization
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/vuln-deserialization
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-deserialization-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security risk of insecure object deserialization by providing a structured, safe, and authorized methodology to detect vulnerabilities without triggering destructive payloads or unauthorized system access.

Core Features & Use Cases

  • Format Discovery: Identifies serialization formats across Java, PHP, Python, .NET, and Node.js stacks.
  • Safe Validation: Uses non-malicious magic-byte probes and time-based oracles to confirm deserialization sinks.
  • Use Case: During a security assessment, use this skill to determine if an application's API endpoints are susceptible to gadget-chain attacks by verifying the presence of deserialization sinks while adhering to strict safety gates and authorization policies.

Quick Start

Use the vuln-deserialization skill to probe the target endpoint for insecure object deserialization using time-based oracle methods.

Frequently Asked Questions about vuln-deserialization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely test for insecure deserialization vulnerabilities without triggering RCE?▼

To safely test for insecure deserialization, use non-destructive time-based or out-of-band oracles to confirm gadget-chain execution. This methodology validates the presence of deserialization sinks without sending malicious payloads that could trigger actual remote code execution.

Can I detect insecure deserialization across different programming language frameworks?▼

You can detect insecure deserialization across Java, PHP, Python, .NET, and Node.js applications. The process identifies specific serialization formats used by each stack to locate deserialization sinks during authorized security assessments.

What is a time-based oracle for confirming a deserialization gadget chain?▼

A time-based oracle is a non-destructive testing method that confirms a deserialization gadget chain by measuring server response delays. It verifies the vulnerability sink exists without executing harmful remote code payloads.

How do I validate authorization before probing an API endpoint for deserialization risks?▼

Validating authorization requires strict adherence to policy-gated execution and authorization cache validation before testing. This ensures all non-destructive magic-byte probes and time-based oracle tests remain within explicitly authorized security assessment scopes.

What are the limitations of using non-destructive probes for finding deserialization sinks?▼

Non-destructive probes confirm the presence of a deserialization sink but do not execute the actual gadget chain. They safely identify vulnerable formats without causing system damage, requiring strict policy adherence to maintain authorized testing boundaries.

Related Skills

Explore More Software Engineering Skills→
riparinoriparino
1

offensive-deserialization

Identify insecure deserialization sinks and gadget chains across Java, PHP, .NET, and Python.

Community
Advanced
sayseven7sayseven7
11

deserialization-insecure

Identify insecure deserialization sinks and generate exploitation paths.

Community
Advanced
ersinkocersinkoc
56

sc-deserialization

Detect insecure deserialization vulnerabilities across Python, Java, PHP, .NET, Ruby, Node.js, YAML, and XML.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

framework-rails

Identify security misconfigurations and vulnerabilities in Ruby on Rails applications.

Community
Advanced