deserialization-php

What problem does it solve?

This Skill helps penetration testers identify and exploit PHP deserialization vulnerabilities, which can lead to remote code execution.

Core Features & Use Cases

• Identify Serialization Formats: Detects common PHP serialization patterns (objects, arrays, strings).
• Exploit Gadget Chains: Leverages tools like PHPGGC to generate and inject malicious payloads using known framework vulnerabilities.
• PHAR Deserialization: Exploits vulnerabilities where PHP filesystem functions process PHAR archives.
• Use Case: A penetration tester finds an application that unserializes user-provided data. They use this Skill to craft a payload that executes arbitrary commands on the server.

Quick Start

Use the deserialization-php skill to generate a PHPGGC RCE1 chain for Monolog and execute the 'id' command, outputting the result as a base64 encoded string.