Thread by @AnukulHexx

Vulnexp 90 | Day53

➡️Insecure deserialization

when an attacker manipulates the way that HTTP requests are interpreted by a web server or a proxy server.

#bugbountytips #bugbountytip

Thread 🧵 : 👇

• Insecure deserialization is a type of vulnerability that can occur in applications that involve the serialization and deserialization of data.

• Serialization is the process of converting an object , data structure into a format that can be transmitted or stored.

• XML, or binary data. Deserialization is the process of converting the serialized data back into an object or data structure.

• When an application receives serialized data, it may deserialize it to reconstruct the original object or data structure. However,

• if the serialized data is maliciously crafted, it may contain instructions or data that can be used to exploit the application. For example, an attacker could serialize a malicious object that, when deserialized, executes arbitrary code on the server or accesses sensitive data

• To prevent this, applications should validate and sanitize all input, including serialized data. This can be done by using a secure serialization format, such as Google's Protocol Buffers or Apache Thrift, which have built-in safeguards against certain types of attacks.

•Additionally, applications should ensure that only trusted sources can provide serialized data, and should validate that the serialized data is well-formed and has not been tampered with.

• Finally, applications should run deserialization in a sandbox or with limited privileges to minimize the impact of any successful attacks.