speech and writing are just serialization for human thoughts #showerthoughts
Chris Frohoff
@frohoffbuilding things, breaking things, building things that break things. ysoserial night janitor. journeyman ctf plumber. he/him
infosec.exchange/@frohoff
- Some very cool research and analysis in this paper, but remember kids: don't assume that fixing/removing/blocking gadget classes is going to protect you if you're still deserializing objects from untrusted dataJava libraries are riddled with deserialization security holes reg.cx/45m9?utm_sourc…
- Also, your internal app logs are not an APIYour database table schema is not an API.
- More fun bespoke Oracle product java deserialization gadget chains and blacklist bypassesAs promised, I and @testanull publish our adventure last year. Hope you enjoy it ! peterjson.medium.com/miracle-one-vu…
- Fun fact: @gebl's URLDNS java deserialization gadget in ysoserial relies on exactly this obscure (and absurd) behavior to trigger a DNS lookup github.com/frohoff/ysoser…
