Deserialization: what, how and why [not]
summary
Code runs live showing Java native serialization bytes and base64 signatures, a hex edit of a base64 session cookie to flip role to administrator, crafted serialized graphs that spin CPU or OOM the JVM, and gadget chains that trigger remote code execution (Apache Commons, Struts examples). Demo uses object generators, ObjectInputStream overrides (resolveClass whitelist) and a netcat reverse shell exploit; exploits work as shown and code plus links are on GitHub for reproduction.
AI-written summary · about
chapters (6)
- 0:00Intro
- 2:20Demo
- 20:04Prevent
- 22:34Denial of Service
- 26:48More sophisticated stuff
- 30:08Remote code execution
related talks
40m[In]secure Deserialization, And How [Not] To Do It
51mMarshalling Pickles
23mMight As Well JUMP: Exploit Development For Java Serialization
35mHow To Find The Next Great Deserialization CVE
41mJava Serialisation: A Modern Fairytale
47mA Modern Fairy Tale: Java Serialization
43mLive hacking: Breaking into your Java web app
49mDeserialization vulns: past, present, and future