{"id":16779785,"url":"https://github.com/petermosmans/deserialization-demos","last_synced_at":"2025-10-05T19:48:59.110Z","repository":{"id":75895056,"uuid":"602099178","full_name":"PeterMosmans/deserialization-demos","owner":"PeterMosmans","description":"Several demo and helper files to learn more about insecure deserialization","archived":false,"fork":false,"pushed_at":"2023-03-06T08:52:57.000Z","size":30,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-16T19:50:46.544Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PeterMosmans.png","metadata":{"files":{"readme":"README.rst","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-15T13:51:59.000Z","updated_at":"2023-02-17T13:07:08.000Z","dependencies_parsed_at":"2023-07-12T00:16:17.693Z","dependency_job_id":null,"html_url":"https://github.com/PeterMosmans/deserialization-demos","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/PeterMosmans/deserialization-demos","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PeterMosmans%2Fdeserialization-demos","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PeterMosmans%2Fdeserialization-demos/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PeterMosmans%2Fdeserialization-demos/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PeterMosmans%2Fdeserialization-demos/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PeterMosmans","download_url":"https://codeload.github.com/PeterMosmans/deserialization-demos/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PeterMosmans%2Fdeserialization-demos/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278510913,"owners_count":25998996,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T07:32:21.466Z","updated_at":"2025-10-05T19:48:59.052Z","avatar_url":"https://github.com/PeterMosmans.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"#####################\nDeserialization Demos\n#####################\n\nAccompanying repository for the Specialized Testing: Deserialization course on\nPluralsight (see\n`https://www.pluralsight.com/courses/specialized-testing-deserialization\n\u003chttps://www.pluralsight.com/courses/specialized-testing-deserialization\u003e`_).\nPlease note that these instructions might differ slightly from the ones being\nshown during the course - this repository is leading.\n\n**************\nWhat is this ?\n**************\n\nThe files in this repository allow you to quickly try out serialization and\ndeserialization using several languages and formats. You can either use the\nscripts directly, or build ready-to-use Docker images containing the scripts.\n\nFurthermore the Docker images contain several other handy (de)serialization\ntools, like `ysoserial \u003chttps://github.com/frohoff/ysoserial\u003e`_, `detect_type\n\u003chttps://github.com/PeterMosmans/deserialization-demos/blob/main/python/detect_type.py\u003e`_,\nand `SerializationDumper \u003chttps://github.com/NickstaDB/SerializationDumper\u003e`_.\n\nIf you don't have access to Make or don't want to build the images yourself: No\nproblem. The images can be found on `Docker hub\n\u003chttps://hub.docker.com/r/gofwd/deserialization/general\u003e`_. Pull the images\nusing:\n\n.. code-block:: console\n\n   git pull gofwd/deserialization:java\n   git pull gofwd/deserialization:php\n   git pull gofwd/deserialization:python\n\n***********************\nBuild the Docker images\n***********************\n\nIn order to build the Docker images, it's easiest to have ``GNU Make`` installed.\nOpen a terminal, clone this repository, and go to the directory containing these\nfiles:\n\n.. code-block:: console\n\n   git clone https://github.com/PeterMosmans/deserialization-demos\n   cd deserialization-demos\n   make all\n\nThis builds (and test) all 3 Docker images:\n\n+ ``gofwd/deserialization:java``\n+ ``gofwd/deserialization:php``\n+ ``gofwd/deserialization:python``\n\n*****\nUsage\n*****\n\nOn each image, the serialization and deserialization scripts can be executed by\nreferencing their name directly. The scripts either expect a filename, or, when\nnot supplied, they can take input from STDIN and output directly to STDOUT.\n\n\nUsing a Docker image, serialize ``MyObject`` and save it to a local file\n``serialized``:\n\n.. code-block:: console\n\n   docker run --rm gofwd/deserialization:java serialize \u003e serialized.java\n   docker run --rm gofwd/deserialization:php serialize \u003e serialized.php\n   docker run --rm gofwd/deserialization:python serialize \u003e serialized.python\n\nDetect which (serialized) type the file ``serialized`` has:\n\n.. code-block:: console\n\n   docker run --rm -v $PWD:/workdir:ro gofwd/deserialization:python detect_type serialized\n\nDeserialize a PHP object from stdin:\n\n.. code-block:: console\n\n   echo 'O:6:\"object\":1:{s:8:\"property\";b:1;}' | docker run --rm -i gofwd/deserialization:php deserialize\n\nDeserialize the file ``serialized``:\n\n.. code-block:: console\n\n   # As a file...\n   docker run --rm -v $PWD:/workdir:ro gofwd/deserialization:java deserialize serialized\n   # ...or by using STDIN\n   cat serialized | docker run --rm -i gofwd/deserialization:php deserialize\n\n*********\nysoserial\n*********\n\nThe image ``gofwd/deserialization:java`` contains the tool `ysoserial\n\u003chttps://github.com/frohoff/ysoserial\u003e`_. This tool creates gadget\nchains to exploit insecure deserialization vulnerabilities.\n\nCreate a gadget chain for Clojure, executing the command is, and save it to\n``exploit``:\n\n.. code-block:: console\n\n   docker run --rm gofwd/deserialization:java ysoserial Clojure 'id' \u003e exploit\n\n***********\ndetect_type\n***********\n\nThe image ``gofwd/deserialization:python`` contains the script\n``detect_type.py``. This script tries to fingerprint the serialization format of\na file.\n\nDetect the type of the file ``exploit``:\n\n.. code-block:: console\n\n   docker run --rm -v $(PWD):/workdir:ro gofwd/deserialization:python detect_type exploit\n\n*******************\nSerializationDumper\n*******************\n\nThe image ``gofwd/deserialization:java`` contains the tool `SerializationDumper\n\u003chttps://github.com/NickstaDB/SerializationDumper\u003e`_. This tool can dump\nserialized Java objects into a more human-readable form.\n\nDump the object that is stored in ``exploit`` in binary format:\n\n.. code-block:: console\n\n   docker run --rm gofwd/deserialization:java SerializationDumper $(xxd -plain exploit|tr -d \\\\n)\n\nNote that the command ``xxd -plain`` converts the binary format to hexadecimal\nformat, and ``tr -d \\\\n`` removes all new line characters.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpetermosmans%2Fdeserialization-demos","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpetermosmans%2Fdeserialization-demos","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpetermosmans%2Fdeserialization-demos/lists"}