10 modules.
| Module | Description |
|---|---|
java-deserialization |
Sends Java serialized-object magic bytes (\xac\xed\x00\x05) and base64 variants (rO0AB) as POST bodies. Detects ClassNotFoundException, ObjectInputStream, and ysoserial traces in error responses. Severity: Critical. |
php-deserialization |
Injects PHP serialized strings (O:8:"stdClass":1:{...}) into POST bodies and cookies. Checks for PHP errors or unexpected object property disclosure. Severity: High. |
python-pickle-deser |
Sends base64-encoded minimal pickle payload to POST endpoints. Detects pickle, _pickle, cPickle, marshal error messages in responses. Severity: Critical. |
dotnet-binaryformatter |
Sends AAEAAAD (BinaryFormatter magic) in POST bodies. Detects BinaryFormatter, SerializationException, and System.Runtime.Serialization error traces. Severity: Critical. |
yaml-deserialization |
Injects dangerous YAML payloads (!!python/object/apply:os.system) into YAML-accepting endpoints. Checks for uid= (command execution) or YAML parser error messages. Severity: Critical. |
snakeyaml-deser |
Tests SnakeYAML (Java) deserialization via ScriptEngineManager / URLClassLoader gadget. Looks for Java error traces or URL resolution attempts. Severity: Critical. |
jackson-deser |
Sends JSON with @class/@type gadget fields to detect Jackson polymorphic deserialization. Checks for class loading errors. Severity: Critical. |
fastjson-deser |
Sends Fastjson @type gadget payloads (JdbcRowSetImpl LDAP trigger, Exception class). Looks for LDAP connection indicators or class errors. Severity: Critical. |
msgpack-deser |
Sends a MessagePack-encoded test map to binary-accepting endpoints. Checks for MessagePack-related errors or unexpected parsing behaviour. Severity: Medium. |
xmldecoder-deser |
Sends Java XMLDecoder ProcessBuilder gadget payload. Looks for command execution output (uid=) or XML parsing errors indicating XMLDecoder processing. Severity: Critical. |
Part of the NOX Module Reference guide.