Questions tagged [deserialization]
The deserialization tag has no usage guidance.
7
questions with no upvoted or accepted answers
4
votes
0
answers
209
views
Is Marshal.load safe for Marsha.dumped data
I want to serialize and deserialize models that contain user input. Marshal is a serialization library built into Ruby.
By design, ::load can deserialize almost any class loaded into the Ruby process....
- 195
1
vote
0
answers
499
views
Why is there no fix for the commons beanutils Java deserialization gadget?
I recently came across a vulnerability which was caused by unsafe deserialization (Java) and the use of the Apache Commons library commons-beanutils. The ysoserial project references commons-beanutils ...
- 2,634
1
vote
0
answers
444
views
How to decode ysoserial .net payload
Is there any way to decode ysoserial .net payload?
For instance
I'm creating payload with:
ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity
Is there any ...
- 11
1
vote
0
answers
165
views
Exploit CVE-2020-0688 for older versions
I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised.
The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
- 11
1
vote
0
answers
1k
views
How do gadget chains work in relation to Java Deserialization attacks?
tl;dr
I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific.
The background
This is my attempt to add specificity to the OP question as requested in ...
- 702
0
votes
0
answers
47
views
How does "./" affects signature generation for files, in a PHP based web application?
I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
0
votes
0
answers
509
views
JSON.Net insecure deserialization
I have a question in regard to insecure deserialization with the JSON.Net component.
It is my understanding that this component is safe by default unless you specify the TypeNameHandling setting to ...
