insecure-deserialization

Interceptors for PHP's native phar:// stream handling in order to enhance security.

PoC for CVE-2022-23940

CVE-2025-31324 & CVE-2025-42999 vulnerability and compromise assessment tool

The EyalSec Python runtime, the best Python security product there is. Run your existing Python app through it unchanged and it reports or blocks attacker-controlled data reaching SQL queries, shell commands, deserializers, file paths and dynamic imports. Django, Flask, FastAPI. Linux, Python 3.9, 3.10, 3.11, 3.12, 3.13 and 3.14.

Insecure Deserialization Insecure deserialization is a security vulnerability that occurs when an application deserializes untrusted data from an external source without properly validating it. This can allow an attacker to inject malicious code into the application, which can then be executed with the privileges of the application itself.

A tiny Flask app vulnerable to Insecure Deserialization

Intentionally vulnerable Flask app for the talk & hands-on workshop "Breaking Python: AppSec vs. OffSec — From Code to Exploit". 10 classic web vulns (SQLi, command injection, LFI, XXE, XSS, SSTI, insecure deserialization, SSRF, IDOR) with a fixed branch, automated PoCs and a manual-exploitation cheat sheet. Educational, local-only.

Secure coding and application security case studies covering buffer overflow, SQL injection, XSS, hardcoded credentials, insecure deserialization, remediation, and validation.

This write-up is based on Portswigger's Exploiting PHP deserialization with a pre-built gadget chain lab.

Curso de OWASP Top 10: de Injections a monitoramento.

Security assessment of OWASP WebGoat using GitHub CodeQL static analysis - findings on XXE, SSRF, insecure deserialization, and SQL injection with remediation.