sk Skill · PentesterFlow
deserialize
Insecure-deserialization playbook — fingerprint the language/format (Java serialized, .NET BinaryFormatter, Python pickle, PHP unserialize, Node serialize, YAML/JSON-with-types), then build a working gadget chain with ysoserial / ysoserial.net / phpggc / custom pickle. Use when you see serialized blobs (rO0/AC ED, base64 ViewState, PHP O:) or a parameter/cookie that deserializes user input.
Open on skills.sh ↗read 2026-09-17
- installs 8w
- 0
- 30-day movement
- starts with the next reading
- Related entries
- 1
- Connections
- 4
yamlpythonjsonjavascriptbashTypeScript
- Host repository
- PentesterFlow/agent
- Allowed tools
- http, shell, read_payloads, file_write
- Host stars
- 1,360
- Host language
- TypeScript