Hands-On Web Penetration Testing with Metasploit

Deserializing the payload

To understand the payload more clearly, we can deserialize it and use var_dump on it. According to the PHP manual, var_dump displays structured information (including the type and value) about one or more expressions. Arrays and objects are explored recursively by var_dump, and values are indented to show structure. We could also use the print_r() function to perform the same operation:

Since we used the payload based on the GuzzleHttp client, we need to have Guzzle installed. We can unserialize it using the following PHP code:

<?phprequire __DIR__ . '/vendor/autoload.php';$obj= unserialize(json_decode(file_get_contents("./payload.txt"))); ...