deserialization-insecure

Guides testing of insecure deserialization to identify vulnerable inputs and select payloads that demonstrate their impact.

When to use it

Use when Java, PHP, or Python applications deserialize untrusted data through mechanisms that may permit code execution, file access, or privilege escalation.

Give it an application to test; it guides identification and confirmation of insecure deserialization using payloads matched to the application.