Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
Insecure Deserialization
Restoring attacker-controlled serialized objects into live code — when the app deserializes user input with a permissive parser, a crafted object can execute methods during restore. Gadget chains make it RCE; even without gadgets, tampering is often auth bypass.
Severity guide
Critical when a gadget chain executes; high when object tampering yields privilege changes; the blob formats themselves are the entry signal.
Where to look
entry points to test first01
Cookies & session tokens
Base64 blobs in cookies (PHPSESSID payloads, remember-me tokens, .NET ViewState) — decode and look for structure.
02
Viewstate/hidden form fields
ASP.NET WebForms — unsigned or MAC-less viewstate is a classic RCE.
03
API request bodies
Endpoints accepting Java/PHP/Python serialized formats directly (rare but exists in enterprise stacks).
04
Message queues & caches
Features importing jobs/sessions from user-influenced stores.
05
Any rO0AB / O: / gASV string
Those prefixes ARE the bug surface — wherever you can inject them, deserialization is happening.
How to hunt it
in order, start to finishRecognize serialized blobs
PHP: O:8:"..." — Java: rO0AB (base64 of 0xACED) — Python pickle: gASV — .NET: base64 after AAEAAAD. Cookies, viewstate, session params all carry them.
Decode and inspect
Base64-decode the blob and read it: class names, property names, user IDs. The structure tells you the language, the libraries in play, and what's tamperable.
Tamper visibly first
Modify a username/role field, re-encode, replay. A privilege change without a gadget chain is already an IDOR-class win — and proves the app trusts client-side state.
Check the integrity layer
Is there an HMAC/signature? Flawed comparison (== vs === in PHP, timing attacks), or a key that leaks elsewhere in the app, breaks it. Nothing? You're done proving tampering.
Try known gadget chains
ysoserial (Java), phpggc (PHP), ysoserial.net (.NET) generate chains for common libraries — test against detected libraries only. One executing chain is full RCE.
Filter & validation bypasses
when your first tries get blocked- 01Type filtering? PHP late-loading tricks and JNDI indirection in Java sidestep naive class denylists.
- 02Signature present? Check for comparison flaws, key reuse across environments, or signature-stripping via parser quirks.
- 03No reflection of output? Blind deserialization still executes — OOB callbacks (DNS/HTTP) prove it.
- 04Cookies double-encoded? Try both raw and URL-encoded forms — validators often check one, parsers the other.
Impact ladder
what makes it payable- 01RCE via gadget chains — the highest-impact primitive on this list.
- 02Auth bypass — role/username tampering in signed-but-unverified blobs.
- 03DoS via object graphs — deep-nested structures exhaust memory.
- 04Source/skeleton disclosure — error messages reveal the server's class map.
Payloads
3 · from PayloadsAllTheThingsO:8:"User":2:{s:4:"name";s:5:"admin";}PHP object signature — O:<len>:"<class>" is the marker to look for.
rO0ABXNyAB...Java serialized object (base64 of 0xACE...) — viewstate/session token form.
gASVI...Python pickle (base64 of 0x80 0x04 0x95) — pickle.loads on user input is RCE.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.