Writing on web security

A java rmi deserialization flaw lets RMI and JRMP endpoints rebuild untrusted objects off the wire, a remote unauthenticated trigger. See how…

An xstream deserialization attack lets XML type coercion pick classes that form a gadget chain. See how type permission allowlists shut the…

fastjson autotype lets a JSON type field pick any Java class at parse time. See how it reaches gadget classes and how…

Jackson polymorphic deserialization lets a JSON type hint pick the class Java builds. See how it triggers gadget chains and how to…

A snakeyaml deserialization flaw lets the default YAML loader build arbitrary Java types from tags and reach code execution. See how SafeConstructor…

The commons collections gadget chain shows how ordinary classpath classes chain reflective calls into code execution when untrusted Java objects deserialize.

Gadget chain discovery starts at a dangerous sink and reasons backward to a deserialization entry point. See why it is a classpath…

Magic methods are the automatic hooks that give deserialization gadget chains their foothold. Learn which ones matter across Java, PHP, Python, and…

Property oriented programming builds deserialization exploits from object properties and existing methods, not injected code. See a small chain explained.

A deserialization gadget chain turns untrusted bytes into code execution using classes already on the classpath. Learn how it works across languages.