Questions tagged [deserialization]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
42 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
1
vote
0answers
46 views

Is Java native serialization safe if objects contains fields that are under attacker control?

I'm currently setting up a Java application that should cache objects in Redis. One of the options to serialize/deserialize the objects is the Java Native serialization. I know that object ...
0
votes
0answers
44 views

Unserialize URI with PHP and nginx to gain RCE

I stumbled upon this abomination in the code base of a project I'm working on and wondered if it constitutes a security issue. $requestUri = explode('?', $_SERVER['REQUEST_URI']); $requestUri = ...
0
votes
0answers
152 views

ysoserial java.rmi.NoSuchObjectException

I am trying to understand java deserialization exploits, and am attempting to use ysoserial to exploit a java RMI instance. In the examples section of the ysoserial git repo, the following command is ...
0
votes
0answers
79 views

JSON.Net insecure deserialization

I have a question in regard to insecure deserialization with the JSON.Net component. It is my understanding that this component is safe by default unless you specify the TypeNameHandling setting to ...
0
votes
1answer
127 views

Is accepting arbitrary COM pointers over a process boundary safe?

I have a legacy Windows application that needs to be looked over in terms of security. During this review something caught me eye. In the out of process COM server I'm looking at is a method that ...
1
vote
0answers
105 views

Exploit CVE-2020-0688 for older versions

I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised. The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
1
vote
0answers
542 views

How do gadget chains work in relation to Java Deserialization attacks?

tl;dr I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific. The background This is my attempt to add specificity to the OP question as requested in ...
0
votes
1answer
125 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...