All right, so the last lecture we talked about Crosseyed scripted, and now we're going to get into
insecure serialisation, which is arguably one of the most difficult attack vectors to understand.
Right.
So if you go to the last top 10 and you look at the description for this vulnerability class, first
of all, you'll see that exploitation of a civilization is somewhat difficult.
It's not easy to do this.
Now, the other thing that's also difficult is that, yes, exploitation of this civilization is difficult,
but the impact can be catastrophic because you can you know, it can lead to remote code execution attacks
where the attackers are able to execute arbitrary commands on the Web server, sometimes leading to
the complete compromise of the underlying Web application and the server itself.
And this is further, I guess, exacerbated by the fact that, you know, decimalization is just it's
just it's confusing, right?
Because you've got Ruby.
Ruby calls it martialing Python.
Python calls it piccolino.
Java calls it, you know, serialisation.
All these different programming languages have their own way of dealing with it.
But let's get into exactly what insecure civilization is.
So in order to understand that, you first need to understand what serialisation is right.
So when you serialize re serialisation, what you're doing when you serialize an object is you're doing
that.
You're taking an object.
OK, so let's say I've got this object and this object.
You know, it's an object, right?
So it has methods and it has classes going this object.
Well, sometimes an application might want to preserve the state of this class.
Right.
It might want to transmit it over the network or it might want to, you know, save it in memory or
persist it from memory to the disk.
And so what serialisation does is it will flatten this object into a bitstream, a stream of ones and
zeroes so they can be easily transmitted or saved into a different state, like saved into a database
or or transmitted across the network, or it'll just, you know, convert it into like a structured
format like Yamal or JSON or something like that.
Well, that's the serialization process.
Then when when the object gets to the other side, the bitstream is restored to the original object
right before it was serialized.
And the problem, of course, is that if the Web application takes basically user supplied input, if
it takes user supplied input and it doesn't do any sanitisation, there's no checks done before.
The bitstream is the serialized.
The attacker might be able to include something malicious right inside of a serialized source and invoke
it in such a way that when the object is serialized, meaning it's converted from a stream into an object,
then the method that was injected by the attacker is then invoked.
And now the attacker is able to perform some, you know, malicious action in the security context of
the vulnerable application.
This is a really big problem.
And one of the issues here is that, you know, these applications are using libraries from all over
the place.
Right.
I mean, they're using, you know, all these third party libraries and it just creates this giant pool
of classes that an attacker can essentially instantiate objects from and then potentially pass harmful
payloads through all of these classes in such a way that they're able to invoke a harmful method when
the bitstream is realized.
So this is a really it's actually a really difficult thing to discover and find because like I said,
there's just so many libraries, right?
You've got Ruby, you've got Java.
Right.
So Java serializing Ruby is martialing.
You've got Python, you've got dot net.
Right.
You've got it's just there's just so many.
And to show you how difficult this is, we show you guys here and clear this out.
I've got berp pro running running on my computer.
Go to extender, you can see here I'm searching for cereal, you can see there's different, you know,
serializing different serializing, you know, extensions that are available for proprio, but they're
language specific.
Freddi Java, you know, image.
They all have their own way of doing things.
And so you really can't it's really hard to scan for this kind of thing.
But the impact, like I said, can be catastrophic.
So what do you do?
Well, in general, you know, you shouldn't be serialize user supplied input or you should make sure
that you're checking maybe by using a digital signature, maybe you can, you know, digitally sign
the serialized bitstream so that when it's serialized by the application, the signature can be checked
to make sure that the integrity of the data source hasn't been tampered with.
Right.
But, you know, this is this is a pretty serious attack vector, you know, digging through a little
more play with know play with Abbas, not actually does have ID serialisation attack inside the framework.
But it's not really it's just denial of service.
So that's really all I have for this.
You know, in the next section, what we're going to do is we're going to take into the whole issue
of using components with known vulnerabilities.
Okay, guys, I will see you in the next year.
We get into that, but.