PHP serialized object found

[random-robbie]

Hey,

Any chance it can display the serialized object or the line it's on?

Help track down the issue.

Currently the output is.

description: PHP serialized object found
host: xx.xxx.com
url: https://xxx.xxx.com/

[TheTechromancer]

Oh yep, the signatures are in excavate:

class SerializationExtractor(BaseExtractor):
    regexes = {
        "Java": r"(?:[^a-zA-Z0-9+/]|^)(rO0[a-zA-Z0-9+/]+={,2})",
        ".NET": r"AAEAAAD//[a-zA-Z0-9+/]+={,2}",
        "PHP": r"YTo[xyz0123456][a-zA-Z0-9+/]+={,2}",
        "Possible Compressed": r"H4sIAAAAAAAA[a-zA-Z0-9+/]+={,2}",
    }

To find it, you could visit that URL in your browser, right-click --> inspect, ctrl+f for "YTo".

[random-robbie]

i've tried this in the past not been able to find it even when using the regex in burp.
that or it's flagged on some base64 for an image.
could really do with it outputting the string it's found so it can be determined if it's correct or not.

[TheTechromancer]

could really do with it outputting the string it's found so it can be determined if it's correct or not.

Yeah I agree that would be ideal.

@liquidsec you wanna take this one?

[TheTechromancer]

Issue made for this one:
#1039