A great video on exploiting .NET deserialization was presented at Insomni'hack 2018 and can be found on YouTube[1].<p>[1] <a href="https://www.youtube.com/watch?v=eDfGpu3iE4Q" rel="nofollow">https://www.youtube.com/watch?v=eDfGpu3iE4Q</a>