47z!h4Ck
Toggle navigation
\ h0m3 /
/ d0Cs \
(current)
\ bl0g /
/ m0Re \
about
repositories
Cv
news
Deserialization Cheet sheets
Deserialization
Deserialization
Exploiting __VIEWSTATE without knowing the secrets
python
Python Yaml Deserialization
php
PHP - Deserialization + Autoload Classes
java
Basic java deserialization
Java DNS Deserialization, GadgetProbe and Java Deserialization Scanner
Java Transformers To Rutime Exec Payload
jndi
JNDI - Java Naming and Directory Interface & Log4Shell
.net
Basic .Net deserialization (ObjectDataProvider gadget, ExpandedWrapper, and Json.Net)
nodejs
NodeJS - __proto__ & prototype Pollution
Client Side Prototype Pollution
Express Prototype Pollution Gadgets
Prototype Pollution to RCE