Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Insecure Deserialization

When an application rebuilds objects from untrusted serialized data, attacker-crafted gadget chains can run code during deserialization itself. Here is how object injection leads to RCE, and why data-only formats are the fix.

5 articles 20 min total Overview to advanced techniques

Start with the overview

Insecure Deserialization3 min read

Insecure Deserialization: How a Serialized Blob Becomes Remote Code Execution

When an application rebuilds objects from untrusted serialized data, attacker-crafted gadget chains can run code during deserialization itself. Here is how object injection leads to RCE, and why data-only formats are the fix.

Read the overview

Insecure Deserialization techniques

4 focused deep-dives
  1. 02 .NET.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling 4 min
  2. 03 JavaJava Deserialization: ObjectInputStream and the Gadget-Chain Problem 4 min
  3. 04 PHPPHP Object Injection: unserialize() and the Magic-Method Chain 5 min
  4. 05 PythonPython Deserialization: pickle, PyYAML and the __reduce__ Trap 4 min