Deserialization labs
Insecure Deserialization
What is Deserialization?
Insecure Deserialization happens when an app reconstructs objects from user-controlled serialized data without validating it. In PHP, Java, Python (pickle) or .NET, the deserialization process can invoke internal gadgets that lead to RCE.
Why practice Deserialization?
It's one of the most reliable paths to RCE in enterprise applications (Java, .NET) and PHP CMS. Recognizing a serialized blob and firing the right gadget chain is a highly-valued skill with little competition. Bounties for a deserialization-to-RCE start at $5,000 and climb fast.
What will you learn with the Deserialization labs?
You'll learn to recognize serialized formats (O: in PHP, rO0 in Java, the pickle opcode, AAEAAAD in .NET), build PHP object injection payloads with magic methods (__wakeup/__destruct), generate chains with ysoserial in Java, and forge pickles that run commands in Python.
Types of Deserialization we cover
- PHP Object Injection
unserialize() over user input + a class with an exploitable __wakeup/__destruct as a gadget.
- Java (ysoserial)
A serialized stream rO0AB... to an endpoint that deserializes it. ysoserial generates the gadget chain (CommonsCollections, etc.).
- Python pickle
pickle.loads() of user data. An object with __reduce__ runs os.system when deserialized.
- .NET
BinaryFormatter/Json.NET with a loose TypeResolver. ysoserial.net generates gadgets for RCE.
How do you find and exploit Deserialization?
A practical playbook — from recon to proof of concept.
- 1
Recognize serialized data
Look for blobs in cookies, parameters or bodies with each platform's recognizable signatures. It's the first sign of deserialization.
PHP: O:4:"User":... · Java: rO0AB... · .NET: AAEAAAD///// · pickle bytes - 2
Identify the platform and the sink
Determine the language and that the data reaches an insecure deserialization function (unserialize, readObject, pickle.loads, BinaryFormatter).
base64 cookie → decode → starts with rO0 = Java serialized - 3
PHP object injection
If it's PHP, forge an object of a class with an exploitable magic method and tune it so its gadget runs your action on destruction.
O:6:"Logger":1:{s:4:"file";s:10:"/tmp/x.php";} (__destruct gadget writes a file) - 4
Java/.NET with ysoserial
Generate the gadget chain with the ecosystem's tool based on the present libraries and send it to the vulnerable endpoint.
java -jar ysoserial.jar CommonsCollections6 'id' | base64 - 5
Python pickle RCE
Build an object whose __reduce__ returns os.system with your command; on deserialization, it runs.
class E: def __reduce__(self): return (os.system,('id',)) → base64(pickle.dumps(E()))
Learn the theory
Academy: Advanced Techniques
Loading labs...
View in full catalog →Frequently asked questions
What is Insecure Deserialization?
It's a vulnerability where the application reconstructs objects from user-controlled serialized data without validating it. The deserialization process itself can invoke the language's internal 'gadgets' that end up executing code (RCE).
How is insecure deserialization exploited?
You identify a serialized blob (cookie, parameter) and the platform (PHP, Java, Python, .NET), and replace it with a malicious payload: a PHP object with a magic method, a ysoserial chain in Java/.NET, or a pickle with __reduce__ in Python that runs commands on deserialization.
How do you find Insecure Deserialization in bug bounty?
Decode cookies and parameters looking for serialization signatures (O: in PHP, rO0 in Java, AAEAAAD in .NET, pickle bytes). If you find a blob deserialized by the server, try forging objects or use ysoserial to generate the right gadget chain.
How do you prevent Insecure Deserialization?
Don't deserialize untrusted data; use data formats that can't instantiate objects (JSON with a strict parser), sign and integrity-check the blobs if they're essential, restrict the allowed types (allowlist) and avoid BinaryFormatter/pickle over user input.
Why does deserialization so often lead to RCE?
Because reconstructing an object runs automatic methods (__wakeup/__destruct in PHP, readObject in Java, __reduce__ in pickle). By chaining classes already present in the app (gadgets), an attacker steers that execution toward dangerous calls like system or spawn.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Deserialization in real labs
Every Deserialization lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime