Performing Java deserialization attacks

Java employs a process called serialization that turns an object into a byte stream. On the flip side, deserialization is the process of returning a serialized stream of bytes to an object in the machine’s memory. In this type of attack, the attacker introduces malicious data into the application code by modifying serialized objects. This attack is only possible if the website deserializes data provided by the user. If user-provided data or any data from sources you don’t trust must be deserialized, checks and safeguards must be implemented to prevent the untrusted sources from altering the data. Checks and safeguards must be done before the start of the deserialization process; otherwise, it will not be effective. Due to the difficulties in preventing deserialization attacks, data deserialization should only be used if it can’t be avoided.

Within this recipe, you will attack a susceptible serialization-based session mechanism...