How to use the Offensive Deserialization Testing agent skill

What the skill makes the agent do

Insecure deserialization happens when an application reconstructs objects from serialized data without checking the type, integrity or origin of that data. Reconstruction can run constructors and language-specific magic methods, so attacker-controlled input can lead to code execution before any application validation runs.

Once installed, the agent follows a workflow from the skill: it enumerates entry points that accept opaque or encoded data (cookies, HTTP bodies, headers, message queues, file uploads, JMX/RMI endpoints), fingerprints the serialization format, selects candidate gadget chains matching the target's libraries, and generates payloads with tools such as ysoserial, phpggc or ysoserial.net. It recommends starting with a harmless proof, such as a DNS-only or sleep-based check, and documenting the full chain.

• Recognises formats such as Java ObjectInputStream (hex ac ed 00 05, Base64 rO0AB), PHP serialize, .NET BinaryFormatter, Python pickle and Ruby Marshal.
• Explains sinks such as ObjectInputStream.readObject(), unserialize() and phar:// file operations.
• Covers Java in detail. The description also lists Python, Node.js, Ruby, Spring, Laravel and Symfony topics, but the SKILL.md body provided only contains the Java sections and a start of the PHP section.

Install the skill from the ZIP

Download the ZIP for offensive-deserialization from this page and unzip it. The skill is a folder containing a SKILL.md file. Place that folder in your personal skills directory, ~/.claude/skills/, or in a project's .claude/skills/ directory if you want it limited to one project.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/.
• Project install: unzip into the project's .claude/skills/ folder.
• Claude apps: upload under Settings → Capabilities → Skills.

Trigger the skill with natural requests

You do not need a special command. The skill activates when your request involves deserialization sinks, serialized data in cookies or request bodies, gadget chain development, magic method abuse, ysoserial payload generation, or a review of marshalling and unmarshalling logic. Name the target, the language and what you have already seen, and state that the engagement is authorized.

• "We have written authorization to test app.example.com. The session cookie starts with rO0AB, so check whether it is Java deserialization and suggest a safe proof."
• "Review this Java code for ObjectInputStream.readObject() on untrusted input and list the sinks."
• "The target is a PHP app on an authorized engagement. A file upload path is passed to file_exists(). Assess whether phar:// abuse is possible."
• "Generate a URLDNS ysoserial payload for confirming deserialization in our test environment."

Example: a safe first check on Java

The skill recommends URLDNS as a detection step because it only performs a DNS lookup and does not achieve code execution. The command below is copied from the skill source. Replace the host with a domain you control for the callback.

• Generate the payload and save it to a file.
• Send it to the identified entry point in the authorized test.
• Check your DNS logs for a lookup to your domain before attempting any other chain.

What you need before you start

The skill requires a Java runtime and the ysoserial.jar tool, which is an external download and is not included. The RMI and JNDI examples also need nmap and marshalsec. Written authorization for the target system is a hard requirement, not an optional extra.

• Java runtime and ysoserial.jar (external download).
• nmap and marshalsec, only for the RMI and JNDI examples.
• Written authorization for every target system.
• Network access to the target and to a callback host you control.

Safety notes on scripts and network use

The skill does not run scripts itself, but it does use the network. Its payloads can make targets connect out to hosts you specify, and some chains execute commands on the server. Use only authorized targets, keep callbacks under your control, and prefer DNS-only or sleep-based proofs before escalating.

The skill explicitly covers escalation to engagement objectives, and that step is only appropriate with written permission. Without authorization, using it against third-party systems is illegal.

• Do not point the skill at systems you do not have written permission to test.
• Use proofs that are harmless, such as URLDNS, before running command-execution chains.
• Record each step so the finished report shows the entry point, format, gadget chain, library versions and proof.

Tips for better results

Give the agent concrete evidence: the cookie or body prefix, the error message, and any library or framework versions you know. The skill's own workflow depends on matching the gadget chain to the target's classpath, so the more you share, the better the chain selection will be.

The Java content is the most detailed part of the file. For PHP, Python or .NET work, expect less guidance from this SKILL.md and verify commands yourself.

• Share error messages, since they can reveal serialVersionUID mismatches.
• Name the library versions in use, because chains such as CommonsCollections depend on them.
• Ask for a proof-of-concept first, then ask for the full write-up.