OWASP Deserialization Cheat Sheet

1. What Is Deserialization

   Serialization, deserialization and why untrusted data is dangerous.

2. PHP

   PHP unserialize risks and safe alternatives.

3. Python

   Pickle and YAML loading hazards.

4. Java

   ObjectInputStream filtering and look-ahead deserialization.

5. .NET C#

   BinaryFormatter and safer serializers.

6. Alternative Data Formats

   Using JSON or protobuf in place of native serialization.

7. Only Deserialize Signed Data

   HMAC signing to ensure integrity before deserializing.

8. Mitigation Tools and Libraries

   Libraries that harden deserialization.

9. Detection Tools

   Tools for detecting deserialization vulnerabilities.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.