Categoría: Insecure deserialization

Exploiting Java deserialization with Apache Commons

Exploiting Ruby deserialization using a documented gadget chain

Exploiting PHP deserialization with a pre-built gadget chain

Arbitrary object injection in PHP

Using application functionality to exploit insecure deserialization

Modifying serialized data types

Modifying serialized objects