deserialization-testing
Tools and techniques for identifying and testing vulnerabilities caused by insecure data deserialization.
Install
mkdir -p .claude/skills/deserialization-testing && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/3245" && unzip -o skill.zip -d .claude/skills/deserialization-testing && rm skill.zipInstalls to .claude/skills/deserialization-testing
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
反序列化漏洞测试的专业技能和方法论Key capabilities
- →Identify serialized data formats like Java, PHP, Python, and .NET
- →Detect deserialization points in application components
- →Generate payloads for Java deserialization vulnerabilities using ysoserial
- →Construct PHP deserialization exploits using magic methods and POP chains
- →Create Python pickle RCE payloads
How it works
This skill identifies deserialization vulnerabilities by recognizing serialized data formats, detecting deserialization points, and constructing malicious payloads for various languages and libraries.
Inputs & outputs
When to use deserialization-testing
- →Identify vulnerable deserialization endpoints
- →Test Java applications for Commons Collections vulnerabilities
- →Validate PHP unserialize() handling
- →Check Python pickle usage for remote code execution risks
About deserialization-testing
Assists in identifying insecure deserialization points in application code and data streams. Provides methods for constructing and testing payloads against common libraries and languages.
反序列化漏洞测试的专业技能和方法论
Limitations
- →Testing must occur only in authorized environments
- →Payload size limitations must be considered
- →Requires understanding of target application's dependency library versions
How it compares
This skill provides specific payload generation commands and code examples for different languages and libraries, which is more direct than general vulnerability assessment.
Compared to similar skills
deserialization-testing side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| deserialization-testing (this skill) | 2 | 6mo | Review | Advanced |
| auth-implementation-patterns | 1 | 4mo | No flags | Advanced |
| senior-security | 31 | 7mo | Review | Advanced |
| security-header-generator | 5 | 9mo | Caution | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Ed1s0nZ
View all by Ed1s0nZ →You might also like
auth-implementation-patterns
sickn33
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
security-audit
ruvnet
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.
security-best-practices
openai
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.