web-deserialization

【数据与研究】Insecure deserialization → RCE via gadget chains. Load when the app deserializes attacker data: Java (rO0/AC ED base64), PHP `unserialize` (O:), Python pickle, .NET BinaryFormatter/ViewState, Ruby Marshal/YAML. Signals: serialized blobs in cookies/params, `__VIEWSTATE`, `rO0AB`, `O:8:`.

独立 GitHub 快照 · 自动分类 · 以原作者文档为准