Exploiting insecure Deserialization

With real world example.

Insecure Deserialization: — To understand it first we have to learn about what is serialization and deserialization.

Serialization: Converting the state of an object into any format like byte stream is known as serialization.

There are so many interpreted language like JavaScript, Excel and PowerShell used for data serialization. After serialization state of objects persisted such as send data over network persist it in XML, JSON format.

Benefits:

· To simplify interaction and generation of documents.

· It is good in communication protocols as we can pass objects in TCP sockets because serialization at one end reflect to other end.

· We can import serialized object into another custom applications.

· Make application structure fragile.

· In relational database, every time no need to create new columns per updating.

Deserialization: Conversion of coming byte stream data from a file (XML, JSON) into network object or in data object is known as deserialization.

Serialization and deserialization is a technique to send and receive data between distributed components of web applications. Most of programming language and modern systems (API, micro services, and 3-tier architecture) uses serialization and deserialization technique as they are highly distributed and components…