'serialization' 검색 결과

Investigate insecure deserialization, where restoring objects from stored or transmitted data can execute unwanted code. Covers multiple languages, input format recognition, vulnerable processing points, verification methods, and documentation of affected libraries and entry points.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing code that restores objects from external data
• Identifying serialized data in cookies and request bodies
• Assessing message consumers and admission webhooks

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides patterns for unit testing JSON serialization/deserialization with Jackson and `@JsonTest`. Validates JSON mapping, custom serializers, date formats, and polymorphic types. Use when testing JSON serialization, validating custom serializers, or writing JSON unit tests in Spring Boot applications.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit PHP object serialization vulnerabilities (Insecure Deserialization). This skill details how to identify unserialize() injection points and construct malicious serialized objects using Property Oriented Programming (POP) chains to achieve Remote Code Execution (RCE).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Kotlin과 Ktor로 HTTP 서버를 만드는 구현 예시를 제공합니다. API 라우트, 인증, JSON 변환, 구성 요소 조립, 통신과 테스트를 정리합니다.

• Ktor로 REST API 만들기
• JWT 인증으로 라우트 보호
• Koin으로 앱 구성 요소 정리

Guides development across the Kilo JetBrains plugin’s shared, frontend, and backend modules. Explains remote calls between modules, UI thread rules, dependency packaging, and testing practices, including serialization failures that require checks in a running IDE.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Placing new code in the appropriate plugin module
• Defining frontend and backend communication
• Reviewing UI threading and coroutine usage

Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Reviews serde serialization code for derive patterns, enum representations, custom implementations, and common serialization bugs. Use when reviewing Rust code that uses serde, serde_json, toml, or any serde-based serialization format. Covers attribute macros, field renaming, and format-specific pitfalls.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit insecure deserialization in Node.js applications (specifically targeting libraries like `node-serialize`) by crafting malicious Immediately Invoked Function Expressions (IIFE) hidden within serialized JSON objects to achieve Remote Code Execution (RCE).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Insecure deserialization — Python pickle, Java, PHP object injection ile RCE

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream and BinaryFormatter sink identification, pickle __reduce__ RCE, phar:// wrapper abuse, Jackson polymorphic typing, Json.NET TypeNameHandling, ViewState tampering, node-serialize IIFE injection, Ruby Marshal.load and YAML.load gadgets, framework-specific chains for Spring/Hibernate/Laravel/Symfony, modern attack surfaces including Kubernetes admission webhooks and message queue consumers, WAF bypass through encoding layers and content-type manipulation, and serialVersionUID/JMX/RMI vectors. Activate when the engagement involves deserialization sinks, serialized data in cookies or request bodies, gadget chain development, magic method abuse, ysoserial payload generation, or any review of marshalling and unmarshalling logic in target applications.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Strengthen existing tests with fast-check by checking properties across generated inputs. Find bugs that example tests miss and reduce failing inputs to small, reproducible cases. Property testing is available; the other listed workflows remain planned.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking parser behavior across generated inputs
• Testing serialization and deserialization round trips
• Finding pure functions covered only by example tests

Domain routing and boundary guidance for authorized insecure deserialization testing, including Java, PHP, Python, .NET, and gadget-chain analysis. Use when a task belongs to the deserialization testing domain and needs scope, evidence, pivot, or exit criteria.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar mechanisms that may lead to RCE, file access, or privilege escalation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security considerations for Jackson JSON deserialization in Java applications. Covers timing of validation, raw input interception, and common deserialization attack patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/rce-results.md. Use when asked to find RCE, command injection, or unsafe deserialization bugs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Choose the right serialization format for .NET applications. Prefer schema-based formats (Protobuf, MessagePack) over reflection-based (Newtonsoft.Json). Use System.Text.Json with AOT source generators for JSON scenarios.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Work with the Upstash Redis JavaScript/TypeScript SDK for serverless Redis operations. Use for caching, session storage, rate limiting, leaderboards, full-text search (querying, filtering, aggregating with @upstash/redis search extension), and all Redis data structures. Supports automatic serialization/deserialization of JavaScript types. Search also available via @upstash/search-redis and @upstash/search-ioredis adapters for TCP clients.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert blueprint for save/load systems using JSON/binary serialization, PERSIST group pattern, versioning, and migration. Covers player progress, settings, game state persistence, and error recovery. Use when implementing save systems OR data persistence. Keywords save, load, JSON, FileAccess, user://, serialization, version migration, PERSIST group.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert blueprint for data-oriented design using Resource/RefCounted classes (item databases, character stats, reusable data structures). Covers typed arrays, serialization, nested resources, and resource caching. Use when implementing data systems OR inventory/stats/dialogue databases. Keywords Resource, RefCounted, ItemData, CharacterStats, database, serialization, @export, typed arrays.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert blueprint for data-oriented design using Resource/RefCounted classes (item databases, character stats, reusable data structures). Covers typed arrays, serialization, nested resources, and resource caching. Use when implementing data systems OR inventory/stats/dialogue databases. Keywords Resource, RefCounted, ItemData, CharacterStats, database, serialization, @export, typed arrays.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.