Injection
Deserialization Attacks
When an application deserializes attacker-controlled data, it can execute arbitrary code before any validation runs. Python's pickle, PHP's unserialize, and Java's ObjectInputStream have ended careers.
Intermediate45 min8 lessons2 hands-on
First lesson free. The full module is part of Pro.
You'll be able to
- ✓Recognise serialized data formats in cookies, request bodies, and API responses
- ✓Craft a malicious Python pickle payload using the __reduce__ method
- ✓Understand PHP magic methods (__wakeup, __destruct) and gadget chains
- ✓Identify Java deserialization entry points and the risks of ObjectInputStream
- ✓Replace unsafe deserialization with JSON and HMAC-signed serialized data