Python deserialization black-box approach.md (#1377)

cheatsheets/Deserialization_Cheat_Sheet.md

@@ -28,7 +28,7 @@ Check the use of [`unserialize()`](https://www.php.net/manual/en/function.unseri
 
 #### Opaque-box Review
 
-If the traffic data contains the symbol dot `.` at the end, it's very likely that the data was sent in serialization.
+If the traffic data contains the symbol dot `.` at the end, it's very likely that the data was sent in serialization. It will be only true if the data is not being encoded using Base64 or Hexadecimal schemas. If the data is being encoded, then it's best to check if the serialization is likely happening or not by looking at the starting characters of the parameter value. For example if data is Base64 encoded, then it will most likely start with `gASV`.
 
 #### Clear-box Review