OWASP Hunting
Server-Side

Insecure Deserialization

Insecure deserialization of untrusted data can allow RCE, authentication bypass, or denial of service via crafted serialized payloads.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Insecure deserialization vulnerabilities occur when untrusted data is deserialized without sufficient validation. Attackers can supply crafted serialized objects that, when deserialized, execute arbitrary code through gadget chains in the application's class path. Common targets include Java, PHP, Python, Ruby, and .NET deserialization.

Attack Vectors

  • Cookie values containing serialized session objects
  • API request bodies with serialized data
  • Database-stored serialized objects
  • Message queue payloads
  • File upload features (YAML, JSON, XML)

Testing Methodology

  1. Identify serialized data in cookies (base64-encoded PHP objects, Java rO0AB...)
  2. Decode and examine the serialized payload structure
  3. Use ysoserial (Java) or phpggc (PHP) to generate gadget chain payloads
  4. Test for blind deserialization with time-based or out-of-band detection

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Java Detection
rO0ABX (base64 Java serialized prefix)AC ED 00 05 (Java serialized magic bytes in hex)aced0005 (hex prefix to look for)
PHP Detection
O:8:"stdClass":0:{}O:4:"User":1:{s:4:"name";s:5:"admin";}a:2:{i:0;s:4:"test";i:1;i:1;}
Python Pickle
cos\nsystem\n(S'id'\ntR. (Python pickle RCE)
YAML Deserialization
!!python/object/apply:os.system ['id']!!python/object/apply:subprocess.check_output [['id']]

Indicators of Vulnerability

  • Application crashes or behaves unexpectedly with malformed serialized data
  • Command execution evidence in response or out-of-band
  • Java deserialization exceptions in server logs

Detection Guidance

Implement deserialization monitoring to detect gadget chain class loading. Use Java agents (SerialKiller) to block dangerous classes during deserialization.

Mitigation & Remediation

  • Avoid deserializing data from untrusted sources
  • Implement integrity checks (HMAC) on serialized data before deserialization
  • Use deserialization filters to allowlist expected classes
  • Keep deserialization libraries patched and updated
  • Use safer data formats (JSON with schema validation) instead of native serialization

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)