Welcome to secure deserialization session.
In this first part, we will focus on threat analysis. We
will take our time to discuss. What serialization? And
deserialization is then, we will discuss how
the system can be harmed. Then, backed off, successful, exploitation,
and give you some insights to identify who
may want to harm your system. Let's start with
serialization, the process of turning some object, into
a data format that can be restored later. Usually,
this is done in order to save objects to
storage or to send them as part of
Stations. Some programming languages have
native support for serialization and deserialization but
others require external libraries to do it since
PHP supports. It natively. We will
discuss the topic using some PHP Snippets. But keep in
mind, I'm not saying that PHP is less secure than any
other programming language. So on
the left, we have the person class definition. It
has a private property called name and the public Constructor, which
accepts the name to be.
Passed as argument to set the private property instances
of person, will be able to print their name,
calling its display underscore name method. Then
we have a class instance. Whose name is Paolo.
Finally, we serialize our instance. This means that
later on, we may want to recreate our person instance, exactly.
As it is now, with the same name and
being able to call the display underscore name method to
get it printed. And this is our serialized instance,
ready to be stored or shared through some Communication channel.
Take your time to figure out the
format PHP using mostly human readable. String format
with letters, representing the data type in numbers,
representing the length of each entry.
When we want to rebuild person instance
from its textual representation, then we need deserialization.
The reverse of serialization process,
taking data structured, from some
format and rebuilding it into an object. If we
want to deserialize custom object like
our person class, then you need to have its definition PHP
provides done. Serialized function to
do it. It takes a textual representation parses it
and creates an instance of a person based on
Permission retrieved from that representation, all
this out of the box with a single line of code.
Very convenient, right? The
problem is the interior lights function. Did it all based on
what was stored into storable Data variable. A
new person instance was created because that
was the object type in the textual representation after
the leading capital O and number six, if
the value of cerebral data variable is something attackers can
control, for example, a cookie value.
Then they can create instances of any other
available class, providing a valid string according to
PHP. Serialization format any source
of user control data, which is deserialized by the
application, represents an attack Vector. Typically
serialized data is stored client-side in cookies or
local storage and later send on subsequent requests in
request, headers or body. If attackers can't
a such values, then they might be able to compromise the
application serialized values.
Are commonly stored in databases, for example session
objects or exchanged between integrated
Services. Exploiting deserialization attackers
might be able to access arbitrary files, imagine
that custom deserialization load some file from
file system based on provided path.
Quite often serialized data includes roles or
privilege. Details, modifying serialized data
may allow attackers to escalate their privileges.
In some cases, special crafted serialized objects may cause
denial of services. During deserialization circular
references are good candidates to exploit it.
In some cases remote code
execution might be possible allowing attackers to gain control
over the system.
Technical skills are required to exploiting security serialization, off-the-shelf
exploits, rarely work, requiring
changes, or tweaks to the underlying exploit code based
on successful, exploitation impact threads
agents, maybe after sensitive information or gain control over
the system, knowledge about the system internals
will greatly help. Attackers to exploiting security,
serialization. You'll find this table in
the last top 10. Pause the video and take your time to
carefully.
Read it.
In the next part, we will exploit insecurities serialization on
our intentionally vulnerable application.