Performing Java deserialization attacks

Serialization is a mechanism provided in various languages that allows the saving of an object's state in binary format. It is used for speed and obfuscation. The turning of an object back from binary into an object is deserialization. In cases where user input is used within an object and that object is later serialized, it creates an attack vector for arbitrary code-injection and possible remote code-execution. We will look at a Burp extension that will assist web-penetration testers in assessing applications for Java Deserialization vulnerabilities.

Getting Ready

Using OWASP Mutillidae II and a hand-crafted serialized code snippet, we will demonstrate how to use the Java Serial...