Skip to content
Get packs

Offensive Deserialization Testing

Guides an agent through insecure deserialization exploitation tests across Java, PHP, .NET, Python, Node.js and Ruby

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill is a security-testing playbook that teaches an AI agent how to find and exploit insecure deserialization flaws, where an application rebuilds objects from untrusted serialized data and can end up running attacker code. Once installed, the agent knows how to recognize serialized formats in cookies and request bodies, pick gadget chains matching a target's libraries, and generate payloads with tools such as ysoserial and phpggc. It also recommends safe harmless proofs first and documenting the full attack chain. The file in this repository covers Java in detail; the description also lists other languages and frameworks, but the provided SKILL.md body only contains the Java sections.

Great for

  • Penetration testers working on an authorized engagement against Java, PHP or .NET applications
  • Application security engineers reviewing whether their own serialization code is exploitable
  • Students learning how deserialization vulnerabilities are identified and demonstrated

Skip it if

  • Attacking systems without written authorization, since the skill explicitly targets third-party hosts and escalation to engagement objectives (illegal without permission)
  • Developers who only need to fix deserialization code; the file focuses on offense and gives little remediation guidance
  • Non-security tasks, because the content is narrow and specialised

Try asking

  • “Review this Java app's session cookie for serialized ObjectInputStream data and suggest which ysoserial chain to test with a DNS-only proof”
  • “Identify deserialization sinks in this codebase that use XMLDecoder, XStream or Jackson enableDefaultTyping”
  • “Explain how to confirm a Java RMI endpoint on port 1099 is exposed during an authorized test”
  • “Build a safe URLDNS payload to confirm that a target deserializes untrusted input”
Step-by-step guide: how to use Offensive Deserialization TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-deserialization.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-deserialization.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-deserialization.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it against systems you own or have explicit written permission to test, and state the scope in your request
  • Ask for DNS-only or sleep-based proofs first to avoid destructive side effects
  • Name the target's libraries and versions when you can, because gadget chain choice depends on the classpath

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.