domains / families / security / exploiting-insecure-deserialization

exploiting-insecure-deserialization

separate

Identifying and exploiting insecure deserialization vulnerabilities in

When to use

• During authorized penetration tests when applications process serialized data (cookies, API parameters, message queues)
• When identifying Java serialization markers (`ac ed 00 05` / `rO0AB`) in HTTP traffic
• For testing PHP applications that use `unserialize()` on user-controlled input
• When evaluating .NET applications using `BinaryFormatter`, `ObjectStateFormatter`, or `ViewState`
• During security assessments of applications using pickle (Python), Marshal (Ruby), or YAML deserialization

Skill page

Source