Php Unserialize Audit
skill-califio-skills-php-unserialize-audit · by califio
Audit PHP engine deserialization surface (unserialize, session decoders, WDDX, phar metadata, custom ce->unserialize handlers, Serializable implementers, magic-method dispatch during deserialization) for UAF via R:/r: back-references, type confusion, partial-object __destruct, signed-length heap overflow, and parse inconsistency. Gathers zval / HashTable / var_hash semantics before launching para…
