Native serialization formats often travel inside cookies, request bodies, queue messages, and opaque Base64 parameters. Several have recognizable stream markers: Java serialization begins AC ED 00 05, modern Python pickle protocols begin with a PROTO opcode, PHP objects and arrays use textual type-and-length structures, and .NET NRBF starts with a structured SerializedStreamHeader record.
tryb identifies those observable format markers locally and never calls readObject(), pickle.loads(), unserialize(), BinaryFormatter.Deserialize(), or any equivalent sink. A match identifies a format—not a working exploit, gadget chain, vulnerable dependency, or reachable code path.
The security risk is conditional but important: when attacker-controlled native serialized data reaches a deserializer that can instantiate dangerous types or invoke compatible gadgets, impact can include code execution, authorization bypass, or data tampering. Confirm the source-to-sink path and replace native object deserialization with a constrained data format and explicit schema wherever possible.
Edge cases worth knowing
- A Java header with no complete object
- AC ED 00 05 is strong evidence of a Java serialization stream, but a short or truncated value may not deserialize. tryb reports the format marker rather than claiming payload validity.
- A protocol-0 Python pickle
- Older textual pickle protocols do not have the same compact PROTO header and are intentionally not guessed from loose opcode-like text, avoiding false positives in ordinary prose.
- A .NET-looking zero prefix
- NRBF has no single universal magic string. Detection requires the record type and version fields in their expected positions; a lone zero byte is never enough.
Common mistakes
- Calling a recognized serialization format remote code execution without proving a vulnerable sink and compatible gadget chain.
- Deserializing suspicious input merely to identify it.
- Treating every Base64 cookie as serialized data.
- Inventing a universal BinaryFormatter magic byte instead of checking the NRBF header structure.