Verified:GitHub

web-deserialization

Name: web-deserialization
Availability: InStock
Author: brucesongs

Detect insecure deserialization vulnerabilities and map gadget chains across Java, PHP, .NET, Python, Ruby, and JSON/XML.

60|14|Updated Apr 27, 2026

Search Tags:#security #web #pentest #deserialization #payloads #gadget-chains

Ready to run

npx skills add https://github.com/brucesongs/kali-claw --skill web-deserialization

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web-deserialization
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/web-deserialization
Command: npx skills add https://github.com/brucesongs/kali-claw --skill web-deserialization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Insecure deserialization vulnerabilities across multiple platforms allow attackers to manipulate serialized data and potentially execute arbitrary code, making applications vulnerable to remote control, data leakage, and service disruption.

Core Features & Use Cases

Cross-platform assessment: Detect and map deserialization weaknesses in Java, PHP, .NET, Python, Ruby, and JSON/XML payloads.
Gadget chain exploration: Identify viable gadget chains and test payloads against target classpaths and frameworks.
Exploitation workflows: Generate and deliver serialization payloads to common entry points (cookies, parameters, API bodies) and verify outcomes via out-of-band callbacks.
Remediation guidance: Provide defense-oriented recommendations for mitigations across languages and frameworks.

Quick Start

Run a cross-platform deserialization test by injecting a crafted payload into a serialized input (cookie or parameter) and monitor the callback channel for evidence of execution.

Frequently Asked Questions about web-deserialization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for insecure deserialization vulnerabilities across Java, PHP, and .NET?▼

Testing insecure deserialization involves identifying serialized data in cookies or parameters, generating payloads using tools like ysoserial.net or phpggc, and verifying execution via out-of-band callbacks. It supports Java, PHP, .NET, Python, and Ruby platforms.

What is a deserialization gadget chain and how does it lead to RCE?▼

A deserialization gadget chain is a sequence of application classes and methods exploited to execute arbitrary code when untrusted serialized data is deserialized. Mapping these chains helps assess remote code execution risks in target frameworks and classpaths.

Can I generate and deliver serialization payloads to API endpoints and web parameters?▼

Yes, you can generate and deliver serialization payloads to common entry points including API bodies, cookies, and web parameters. Tools like ysoserial.net, phpggc, and marshalsec help craft payloads, while callback infrastructure verifies successful exploitation.

Does this deserialization assessment approach work with JSON and XML payloads?▼

Yes, this deserialization assessment works with JSON and XML payloads alongside Java, PHP, .NET, Python, and Ruby. It detects weaknesses in APIs and web applications where serialized data flows through parameters, enabling gadget chain mapping and payload generation.

What tools do I need to map gadget chains and verify deserialization exploitation?▼

You need tools such as ysoserial.net, phpggc, GadgetProbe, and marshalsec to map gadget chains and generate payloads. Additionally, callback infrastructure is required to deliver payloads and verify out-of-band execution outcomes.

How do I mitigate insecure deserialization risks after detecting vulnerable code paths?▼

To mitigate insecure deserialization risks, you should apply defense-oriented recommendations specific to your language and framework. This includes avoiding native deserialization of untrusted data and implementing safe alternative parsing methods.