Marshalling Pickles
summary
Deserializing objects in Python, Ruby and Java lets attackers turn session blobs and view state into remote code execution by stuffing crafted object serialization streams into cookies, Redis keys or RMI registries. A generator produces multiple gadget chains (four shipped for Commons‑Collections/Spring/Groovy) that serialize runtime exec payloads, a JSF view state demo replaces the hidden blob via clipboard and executes a reverse shell (server logs show a 500 after successful detonation).
AI-written summary · about
chapters (12)
- 0:00Start
- 4:31Class Description
- 7:21PHP Serialization Format
- 10:13Java Server Faces
- 16:50Property-Oriented Programming / Object Injection
- 28:40Gadget Chain Construction Code and Call Tree
- 30:20Code Execution via Java Serializable
- 33:43Property Oriented Programming: Limitations & Caveats
- 37:54Restrict Deserialization
- 40:37Authenticate
- 44:28Sample Apps and Tools
- 46:15Past Work / References
related talks
34mDeserialization: what, how and why [not]
40m[In]secure Deserialization, And How [Not] To Do It
23mMight As Well JUMP: Exploit Development For Java Serialization
44mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
47mA Modern Fairy Tale: Java Serialization
02h 27mHow hacking works (Workshop edition)
42mModern web application bugs
35mHow To Find The Next Great Deserialization CVE