Performing Java deserialization attacks

Serialization is a mechanism provided in various languages that allows the saving of an object’s state in binary format. It is used for speed and obfuscation. The turning of an object back from binary into an object is deserialization. In cases where user input is used within an object and that object is later serialized, it creates an attack vector for arbitrary code injection and possible remote code execution. We will look at a Burp Suite extension that will assist web-penetration testers in assessing applications for Java deserialization vulnerabilities.

Getting ready

Login to your PortSwigger account. Using Lab: Exploiting Java deserialization with Apache Commons (https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-java-deserialization-with-apache-commons) and a hand-crafted serialized code snippet, we will demonstrate how to use the Java Deserialization Scanner to assist in performing...