wgpsec/aboutsecurity

deserialization-methodology

不安全反序列化漏洞利用。当发现 Base64 编码的 Cookie/参数、Python pickle 数据、PHP serialized 字符串(O:4:...)、Java serialized 数据(rO0AB...)时使用。可直接获取 RCE

First seen Mar 25, 2026

Installation

$ npx skills add https://github.com/wgpsec/aboutsecurity

View on skills.sh ↗ GitHub repository ↗

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

deserialization-insecure Similar name

>- Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize un…

Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .…

hunt-deserialization Similar name

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), …

Other skills from wgpsec/aboutsecurity · top by installs.

npx skills add https://github.com/wgpsec/aboutsecurity

More details

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared

Cursor Not declared

Codex Not declared

GitHub Copilot Not declared

Windsurf Not declared

Gemini CLI Not declared

Cline Not declared

OpenCode Not declared

Stars 1.7K

Default branch master

Open issues 0

Status Active

npx skills add https://github.com/wgpsec/aboutsecurity