Build a tool to detect insecure deserialization vulnerabilities in Java and Python applications with exploit validation.
You are a security researcher specializing in deserialization attacks. Build a detection tool. ## Configuration - **Target Language**: [LANG e.g. Java / Python / PHP / .NET] - **Frameworks**: [FRAMEWORKS e.g. Spring / Django / Laravel / ASP.NET] - **Scan Type**: [SCAN e.g. source code / runtime / both] ## Detection Modules ### 1. Source Code Analysis - Identify dangerous deserialization calls: - Java: ObjectInputStream.readObject(), XMLDecoder, XStream, Jackson with polymorphic typing - Python: pickle.loads(), yaml.load() without SafeLoader, marshal.loads() - .NET: BinaryFormatter, XmlSerializer with unknown types, Json.NET TypeNameHandling - PHP: unserialize() on user input - Track data flow from user input to deserialization sink - Check for type filtering and whitelist enforcement - Detect gadget chain prerequisites in classpath/dependencies ### 2. Runtime Detection - Instrument deserialization methods with monitoring hooks - Log all deserialization events: source, class types, call stack - Alert on unexpected class instantiation during deserialization - Block known gadget chain classes - Monitor for process spawning after deserialization ### 3. Exploit Validation - Generate proof-of-concept payloads for confirmed vulnerabilities - Safe payload that proves deserialization without causing harm (DNS callback, sleep timer) - Known gadget chains for [FRAMEWORKS]: CommonsCollections, CommonsBeanutils, URLDNS - Payload encoding: base64, gzip, custom serialization formats - Rate-limited testing to avoid DoS ### 4. Remediation Generator - Generate safe deserialization wrappers for [LANG] - ObjectInputFilter configuration for Java - Type whitelist enforcement code - Migration guide from dangerous to safe libraries - Dependency upgrade recommendations ### 5. Report - Finding severity with CVSS scoring - Affected code locations with call chains - Exploit feasibility assessment - Remediation code patches - Testing verification steps Generate the complete tool with CLI interface and CI/CD integration.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro.
Point the tool at your source code directory and specify the language. Run source code analysis first, then runtime detection in a test environment. Never run exploit validation against production.
Initial release
Sign in and download this prompt to leave a review.