https://th3b0ywh0l1v3d.github.io/tags/deserialization/ Recent content in Deserialization on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ A Pyodide client serializes requests with pickle obfuscated by a hardcoded XOR key, letting the server pickle.loads attacker data for unauthenticated root RCE, then hooking the live handler to capture the adminbot’s plaintext login password.