#Insecure Deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application, inflict a denial of service (DoS) attack, or even execute arbitrary code upon it being deserialized. Object and data structure related attacks where the attacker modifies application logic or achieves arbitrary remote code execution if there are classes available to the application that can change behavior during or after deserialization. Typical data tampering attacks, such as access-control-related attacks, where existing data structures are used but the content is changed. Serialization may be used in applications for: -Remote- and inter-process communication (RPC/IPC) -Wire protocols, web services, message brokers -Caching/Persistence -Databases, cache servers, file systems -HTTP cookies, HTML form parameters, API authentication tokens The only safe architectural pattern is not to accept serialized objects from untrusted sources or to use serialization mediums that only permit primitive data types. If that is not possible, consider one of more of the following: #Implementing integrity checks such as digital signatures on any serialized objects to prevent hostile object creation or data tampering. #Enforcing strict type constraints during deserialization before object creation as the code typically expects a definable set of classes. Bypasses to this technique have been demonstrated, so reliance solely on this is not advisable. #Isolating and running code that deserializes in low privilege environments when possible. #Logging deserialization exceptions and failures, such as where the incoming type is not the expected type, or the deserialization throws exceptions. #Restricting or monitoring incoming and outgoing network connectivity from containers or servers that deserialize. #Monitoring deserialization, alerting if a user deserializes constantly. Credits : @kishorkumar3854 Join @sec_army for Daily Hacktivity & Knowledge Dose. #cybersecurityawareness #cybersafety #ethicalhacking #hacking #hackingtools #learnhacking #kalilinux #cyberhunter #cyberattack #cybersecurity #cyberarmy #instacybersecurity #wearesecarmy https://www.instagram.com/p/B3rovp-gaBA/?igshid=1glrjbsyy07yr