Java Deserialization

What is serialization? Serialization is the process of converting the state of an object into byte streams to save into the file. Why do we need Serialization? Let’s take an example of a computer game, when we start the game we get the option to resume it. Now think about, how it’s possible that the game starts from…

Introduction: Before going into actual vulnerability let us understand what is serialization and deserialization of object in java. In java, an object is a member (also called an instance) of a Java class. Each object has an identity, a behavior and a state. The state of an object is stored…

Moitors is a hard-rated box in hackthebox by @TheCyberGeek. It was a really fun box. The best thing I like about this box is, it makes you feel that you are doing a real life pen-test. …

Arkham is a Medium-difficulty box that I picked up in order to get familiar with deserialisation vulnerabilities for the OSWE exam. Nmap shows that IIS 10.0 is running and SMB is open. I check out port 80 and see the default IIS page.

Hi All, Welcome to my new blog on Java De-serialization. In this blog we will understand the basics of Java Deserilization, how is it vulnerable and how can this vulnerability be remediated. …

Introduction Among other tasks, the Vulnerability Detection (VD) team at Tenable Research is responsible for ensuring the detection provided by Nessus to our customers is kept accurate & up to date with the latest vulnerabilities. As part of this process, we occasionally develop custom exploits. In this post I will outline…

Recently, after a long time, I had the opportunity to look more in the java serialization mechanism. As a developer, mostly we are using java serialization based on the requirements. Here are some must-know facts of the Java Serialization mechanism. Note: All the code samples are uploaded to GitHub and…

By Ahmed Sherif & Francesco Soncina In this article, we are going to show you our journey of exploiting the Insecure Deserialization vulnerability and we will take WebGoat 8 deserialization challenge (deployed on Docker) as an example. The challenge can be solved by just executing sleepfor 5 seconds. However, we…