Magic bytes in cookies/parameters: `rO0AB` (Java), `O:` (PHP), `\x80` (Python pickle) - Content-Type headers: `application/x-java-serialized-object` - Custom headers carrying encoded data - Base64-encoded binary data in unexpected locations