deserialization-insecure

An insecure-deserialization attack playbook for authorized security testing, spanning Java, PHP, Python, .NET, and Ruby. It focuses on the practical gap between finding a deserialization sink and landing a working gadget chain. The guidance begins with traffic fingerprinting: recognising serialized data by its magic bytes and encodings across cookies, POST bodies, headers, and message queues (Java's AC ED and its Base64 form, the PHP object pattern, Python pickle protocol markers, and .NET/Ruby signatures). For Java it walks through ysoserial-based exploitation, choosing among the CommonsCollections, Spring, Groovy, and Hibernate chains, and using the DNS-only URLDNS chain as a damage-free confirmation probe before escalating. Framework-specific sections cover Apache Shiro rememberMe (SHIRO-550 / CVE-2016-4437) and its known default keys, WebLogic over the T3 and IIOP protocols and via XMLDecoder (CVE-2017-10271), and the Java RMI registry, alongside a JDK-version matrix explaining when remote class loading is available or must be bypassed. PHP coverage explains the unserialize magic-method chain and PHAR attacks; Python coverage addresses pickle abuse. A companion reference adds a gadget-chain version-compatibility matrix and further formats such as SnakeYAML, Hessian, Kryo, XStream, and .NET ViewState. It is intended for penetration testers and security researchers working under authorization.