So there's no in this video we're going to talk about this in the clear.
Before that, we will cover that report about the serialisation.
And this hearing is supposed to be held to the PC.
So this is my computer and this is the Web server.
Let's for sure.
And this is for database.
So, baby.
So sorry for drinks, so you will send so much data to this Web server is in the request, but there
are.
There are anyway.
So you may send numbers one, two and characters extra.
So sometimes he will have to send the CSB first, you have to send the video first and so much data
so this observers can implement the serialisation.
So this utilization is transforming any data to a single format that is like Sarposa and.
And coding, so encoding will get the Xeroform or some other X format, so this X format will be stored
directly in the database by the Web server.
So this is called serialisation, changing the normal data into some by raw data or something to say
X format by applying some algorithms, you see.
So this is very easy because the database doesn't need to do this value and no need to worry about the
data type and Skouras schema to store and address problems.
So it just simply stored this Serasa data.
So it will be very easy for transport from one database to another database.
No need to worry about this.
So in this database, the serialisation serializer data will be stored.
So upon retrieval, the series of data will be decided either by the Web server.
So it will be decelerator back to this normal format B or whatever.
So in this matter and this matter, the decoding or whatever the operation performed here, it will
be a reverse operation to this operation.
So this is called decentralization.
So transforming that Serasa data or some other raw data into the actual meaningful data is called decentralization.
And the Web server after this transition will get the result in the computer.
So that is the segregation and discrimination.
Suppose if any Web server is using the programming language like Ruby, which is called martialing.
So serialisation is Kamari and in Python is catheterization and serialisation in common.
So suppose there is a vulnerability in programming language.
So this encoding and every data you can send, even the reversal.
So if you send the reversal, it will encode this and it will execute in the Sarasate upon distribution
it will execute.
So, uh, you can send a reversal in the encoded format so that for the theater, what this serialization
transforming normal actual data into the uh, some C is a minor C that are X format data by applying
some diagrams and coding and then it be stored in the database.
So then you can retrieve those data and you can trace it back into this normal data in meaningful use
and useful data.
This is consideration and decentralization.
So what is the insecure disillusionments?
You can execute the call upon busy raising the process upon disclosing the data.
So let's go to distract me or I start to do so.
We have already done this crosseyed scripting room, but we do not get the answer.
So let's focus on this insecurity situation so you can operate this theory.
And I use the issue to read the story and tomka application.
I think some so many.
I said, are you OK?
Let me just focus on the main concept.
So it's an in object oriented programming.
Don't worry about this.
Will we have called in the python instead and behavior.
So it's the state like whether it's, uh, uh, what color the properties of the object itself is casted.
So whether the word is white color or pink color or any other color.
So that is a state, uh, behavior means, uh, the action that is the object is.
I can see that particular object and I can have different types of verbs, so and verbs, consumables,
etc. So different what parts and there should be on and off.
So that is card behavior.
So on and off behavior and state would be the types of these verbs.
So they have asked the same question, if Doug was sleeping, it, this would be a behavior that it
doing some action and it is sleeping.
So let's go through this deterioration.
They have given a Web server and are the client.
It is sending the password, one, two, three.
So they are converting the sponsor into binary format so that we ask you to Benetti and they are sending
in that database so this database can be exported into some other format and they can erase the binary
format.
So this is a binary, so let's answer this one.
So let's also answer this one, make sure that we have done this our.
So now let's go to these cookies.
So kookiest told the station information, so you can see this one, we use cookies to ensure the best
user experience for almost any websites like Amazon, Flipkart, etc..
So why this is because they need to track you over behavior towards the website, whether you are using
the electronics, whether you are using the mobiles or any other shopping materials, and they will
keep the track in the cart and they will you some more products related to your search in their website
so far that they will use the cookies.
And you can see this is the typical cookie, the type of this one that is like a variable name and IP
address and a session MJM and the value of this variable.
So as you can see, this is the description of this cookie.
Cookie can have a name and where this is very common because the cookie main attributes are name and
value and they can be extra attributes.
Security expert, but.
And they have some given some example, and you can see that so you can get the part of the camera.
But what they were that was the user has to use this is the same you are in block plugin.
So let's do this kookiest practical from here on.
What?
We just paid some attention.
So let's go to this website.
And they have given some cookies and we to they are asking to change.
It is key to to get the admin flat.
So let me go to my car, the next machine, and let me go into this website.
So explain your exchange to this exchange there and sign up, let's say Nicole, Nicole.
All right, username, user and exchange ideas, click on this inspect element and don't you can see
the storage and the storage you can see are the stored information like cookies, another attribute
where you can see and this is better.
I think we could be this could the.
So let me give it a try.
So there is a call.
They shot this one and sent it to base64.
By Assadi.
So it's not a flag, sorry, father.
It's not a flag and no type, you need to change this to a Edwin to get the advantage, but that's what
they're seeing.
So double click on the left are you are commonly used to modify the contents.
Now, let me read this page.
And you can see we have got the urban dashboard and there is this front, copy this.
So this is the CDC data, so we can all see this now, it may be serializer on the Sarasate.
Maybe this is not surprising this session is raising and is getting serious.
So, I mean, that's what this one.
And we need to give you.
The flag is Kimberly.
September.
Where is this cookie, where you.
All right, OK, let's go.
Maybe I just want you to go to the movie where you hear.
So let's move on to another one that is correct.
This is very interesting one, so I need to click on this exchange.
So let's go ahead and click on this exchange with.
So I think we need to click on this, provide feedback, provide feedback, so click on this, provide
your feedback.
So asking for username and my comments that you can inject the reversal in the incorrect, because if
you send it or whatever, it will be decoded again.
And basically that's what we need to encode it in the bases of what and when it is, uh, it will automatically
decode into a normal format and then articulate.
So this is, uh, in Python.
They are using this particular model and bigger model is used to select the data and then you get the
picture better, then we're encoding it in the best forward and there then just setting the cookie.
So this is the server side code.
You can see the data and you're encoding with base64.
And you can see this is the question that Mr. Gettelfinger apparently are asking for, and we are decoding
this so we can print in a normal format so we can also use without Python programming.
So they have given this code.
So now to execute this reversal, we need to encode this in the basis of our format.
So this is the call they had.
Condra And.
And copy this one and it's and put pasted in our and I rc not, but let's say the same with with the
same name they could have.
But we need to change this reversal.
Uh, called.
To this IP address to our and zero IP address, because that's where we are connected to this IP.
So let's compare this.
And pasted in here, let's say the fourth one, two, two, one, two, three, five, one, two, three,
four.
Right now, what we're going to do is we need to just let me show you this.
So first, we are putting all the modules in the patent system.
And this for this RCC will accept and accept the object.
So this will execute this.
This is a reversal and this will encode in a basic shiver and then it will be up on the Sarasate, D.C.
release and it will unlock the data and then execute this command so that Python three are set up to
generate this base64 type of our perrottet in the bases for format so that we copy this.
And now we need to paint this in this and this and this one, so before that, we need to go on and
present using this and see my niece will be one, two, three, five.
And we are going on listening on this fourth.
And let me read this page.
So this probe will be sent to the server and it will decode and D.C. release and then we will get there.
So we have successfully got the shell, we can say, and less.
So this is after that is the flask.
Uh, this looks like similar to Jianguo also.
So I think we should go to the home territory home to get the flag.
So we have successfully got this pregnant.
A less sympathetic.
Unless and there is our dirty H.T..
So it is a pleasure to be here.
So this is all this insecure.
So in this Python application, they have this particular module, it will simply execute whatever we
have sent.
But we should send in a format that is the server is anchoring the service and calling the bases.
That's why we have created this basis for encoding and we have series this command.
So on the server side, it has decoded and DC Razib.
And then this comment got that executer.
So that's why we got the reverser.
I hope you understood that server, this insecurity serialisation.
Once you practiced this in this machine, you'll get easily understood.