I have been reading up on Insecure Deserialization and how it can affect Java applications.
If the captured traffic data include the following patterns it may suggest that the data was sent in Java serialization streams:
"AC ED 00 05" in Hex "rO0" in Base64 Content-type = 'application/x-java-serialized-object'
Burp extension to perform Java Deserialization Attacks:
My question is if a similar pattern exists for .NET? Are there any tools to test exploits for this?
The article below mentions a
JSON deserialization flaw in Breeze,
JSON deserialization flaw in NancyFX and
XML deserialization flaw in DotNetNuke,
I have been reading about XML External Entity (XXE) injection for System libraries but nothing with deserialization in .NET.