Deser learning path

Orientation and first principles — what the bug class is and how it behaves.

1. The Anatomy of Deserialization Attacks
   5 min readcobalt.io2026
   Reference detailing deserialization attack techniques across PHP, Python (using pickle), Node.js, Java, and .NET. It covers how vulnerabilities arise from processing untrusted serialized data, enabling attacks like Remote Code Execution (RCE), SQL injection, and path traversal through PHP magic methods (__wakeup(), __destruct()), Python's pickle module, and Java's ObjectInputStream. Detection tools like Ysoserial, Ysoserial.net, and various Burp plugins are mentioned, alongside remediation strategies focusing on using alternative data formats like JSON/XML and deserializing only signed data.
2. Insecure Deserialization Tutorial and Examples
   9 min readlearn.snyk.io2026
   Tutorial on insecure deserialization, demonstrating attacks on a video game API by manipulating serialized Java objects. It covers understanding serialization, using tools like `jdeserialize` and `hexdump` to modify payloads, achieving state manipulation by changing item quantities, and ultimately performing remote code execution by leveraging gadget classes within Java frameworks. The tutorial emphasizes that relying on obscurity for security is ineffective and stresses the importance of robust input validation.
3. OWASP Deserialization Cheat Sheet
   11 min readcheatsheetseries.owasp.org2026
   Reference for safely deserializing untrusted data, this OWASP cheat sheet details vulnerabilities and mitigation techniques across PHP, Python, and Java. It covers identifying insecure usage of functions like `unserialize()` and `pickle.loads()`, and advises on hardening Java's `ObjectInputStream` through subclassing or agents, mentioning libraries like SerialKiller and NibbleSec. The guide emphasizes using safe interchange formats like JSON and protecting sensitive data by declaring fields as `transient`.
4. Insecure Deserialization Explained with Examples
   11 min readthehackerish.com2026
   Library for learning about and exploiting insecure deserialization vulnerabilities. It provides detailed explanations and code examples for PHP object injection (including Phar deserialization), Python pickle deserialization, and Java deserialization. The library covers vulnerability definitions, impact, real-world CVE examples, exploitation techniques using custom code, and mitigation strategies, with exercises in OWASP WebGoat and real-world bug bounty report analysis.
5. Introduction to Deserialization Attacks
   9 min readowlhacku.com2026
   Walkthrough of deserialization attacks, covering serialization basics in Python with `pickle` and PHP with `serialize`. It details how untrusted input during deserialization can lead to critical vulnerabilities like remote code execution (RCE) by loading unexpected classes or executing dangerous code paths. The entry includes a Python Flask application demonstration showcasing the process and the associated risks.

Real testing methodology, tooling, and writeups that show the work.

1. Ruby Vulnerabilities: Exploiting Open, Send, and Deserialization
   19 min readbishopfox.com2026
   Library for exploiting common Ruby-specific remote code execution vulnerabilities, including insecure use of the `open` function, malicious `send` or `public_send` calls, and binary deserialization gadget chains. It provides a walkthrough and a vulnerable Ruby on Rails application to demonstrate exploitation techniques found during an assessment.
2. ysoserial.net: Deserialization Payload Generator for .NET
   18 min readgithub.com2026
   Tool for generating .NET deserialization payloads, inspired by ysoserial. ysoserial.net provides gadget chains from common .NET libraries to exploit unsafe deserialization, wrapping user-specified commands within these chains. It supports various gadget types like ActivitySurrogateDisableTypeCheck, AxHostState, and DataSet, and works with multiple formatters including BinaryFormatter, Json.NET, and SoapFormatter, enabling remote DLL loading and arbitrary code execution when vulnerable applications deserialize malicious data.
3. Marshal Madness: A Brief History of Ruby Deserialization Exploits
   8 min readblog.trailofbits.com2026
   Library detailing the historical evolution of Ruby Marshal deserialization exploits, from early bug tracker issues by Charlie Somerville Hailey to modern industrialized gadget discovery techniques. It traces the decade-long cycle of patches and bypasses, highlighting contributions from researchers like joernchen, Luke Jahnke, and Alex Leahu, and discusses the ongoing challenges presented by these vulnerabilities, referencing CVEs from Java and PHP as comparative examples.
4. PayloadsAllTheThings - PHP Deserialization Payloads
   6 min readgithub.com2026
   Library detailing PHP Object Injection, a vulnerability allowing code execution, SQL injection, and path traversal via improper sanitization of input to `unserialize()`. It covers exploiting magic methods like `__wakeup()` and `__destruct()`, using the `phar://` wrapper, and provides payloads for common frameworks, including examples generated by the `phpggc` tool. The resource also outlines how to identify vulnerable code by searching for `unserialize()` calls and relevant magic methods.
5. Pickle Deserialization in ML Pipelines: The RCE That Won't Go Away
   12 min readafine.com2026
   Library of Python tools and techniques for mitigating pickle deserialization vulnerabilities in ML pipelines. This library addresses the persistent RCE risk posed by `pickle.loads()`, which can execute arbitrary code during deserialization. It covers exploitation vectors including direct model file loading, supply chain attacks on platforms like HuggingFace, and emerging threats in LLM serving infrastructure such as CVE-2025-32444 in vLLM and CVE-2026-26220 in LightLLM, where untrusted data is deserialized over network sockets.

Novel research, edge cases, and the techniques that push the class forward.

1. Java Deserialization Tricks - Synacktiv
   21 min readsynacktiv.com2026
   Library of techniques for evading WAFs and EDRs during Java deserialization exploitation. This library focuses on stealthy RCE, demonstrating how to bypass pattern detection by renaming packages and modifying gadget chains, as well as utilizing the Translet API to inject custom Java code at runtime. It provides methods to avoid detection from common security solutions like WAFs and EDRs by obfuscating strings and injecting bytecode, offering alternatives to direct command execution.
2. Ruby 2.x Universal RCE Deserialization Gadget Chain | elttam
   11 min readelttam.com2026
   Library for universal RCE deserialization in Ruby 2.x, detailing exploitation techniques. This resource describes how to achieve arbitrary command execution by discovering and chaining available gadgets from the standard library, overcoming limitations of previous methods that required specific gems like ActiveSupport and ERB. It covers identifying gadgets that can dynamically load other libraries, including those that partially control the `require` argument, to expand the attack surface and execute system commands.
3. Now You Serial, Now You Don't — Systematically Hunting for Deserialization Exploits | Google Cloud
   16 min readcloud.google.com2026
   Library for hunting deserialization exploits, featuring tools like HeySerial.py for rule generation and CheckYoself.py for validation. This resource details the systematic research process used to develop these tools, enabling the detection of exploitation attempts against vulnerabilities in Exchange (CVE-2021-42321), Zoho ManageEngine (CVE-2020-10189), Jira (CVE-2020-36239), Telerik (CVE-2019-18935), Jenkins (CVE-2016-9299), and log4j (CVE-2021-44228), by identifying gadget chains and malicious payloads.
4. The Art of Hide and Seek: Pickle-Based Model Supply Chain Poisoning
   47 min readarxiv.org2026
   Library for detecting and bypassing pickle-based model supply chain poisoning in Python AI/ML frameworks. It systematically discloses the poisoning surface across model loading paths and risky functions, identifying 22 overlooked loading paths and 133 exploitable gadgets. The research also introduces Exception-Oriented Programming (EOP) to bypass scanners, demonstrating robust vulnerabilities missed by current detection solutions like PickleScan and ModelScan, and leading to a $6000 bug bounty.
5. Precise and Effective Gadget Chain Mining through Deserialization-Guided Call Graph Construction (USENIX Security 2025)
   2 min readusenix.org2026
   Tool for precise gadget chain mining using deserialization-guided call graph construction. This approach addresses limitations of existing methods by incorporating controllability analysis, hybrid dispatch techniques, and recovery of missing call edges due to reflection. Evaluated on 30 applications, it demonstrated improved recall and precision, detecting numerous new gadget chains and previously unknown exploitation methods for vulnerabilities like those related to Java deserialization.
6. Deserialization Gadget Chains in Android: An In-Depth Study
   2 min readarxiv.org2026
   Analysis of Java deserialization gadget chains in Android, using a novel detection tool to analyze the Android SDK and third-party libraries. The study found that the Android SDK contains trampoline gadgets similar to the Java Class Library and can trigger Java native serialization via the Parcel API. However, despite extensive testing, no security-critical gadget chains were discovered in the analyzed Android codebases, suggesting the problem is less prevalent than commonly assumed.
7. Deep Dive into Fastjson Deserialization Vulnerabilities
   medium.com2026
   Deep Dive into Fastjson Deserialization Vulnerabilities
8. Gleipner: A Benchmark for Gadget Chain Detection in Java Deserialization Vulnerabilities
   dl.acm.org2026
   Gleipner: A Benchmark for Gadget Chain Detection in Java Deserialization Vulnerabilities